Asp.net 动态SQL查询

我试图检索基于年份、教员、季度和课程的信息。取决于用户希望的具体程度（年度、季度、课程等的教员）

当我试图检索有关员工“A”的2000年信息时，我遇到了一个错误：“Employee”附近的语法不正确”。代码中没有“Employee”，只有Employee中的“Employee”。当我在“Employee”之间添加空格时，我遇到了相同的错误，只是它说：“Employee”附近的语法不正确

错误报告：

Incorrect syntax near 'Employee'. 
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near 'Employee'.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace: 


[SqlException (0x80131904): Incorrect syntax near 'Employee'.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +2073502
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +5064460
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning() +234
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +2275
   System.Data.SqlClient.SqlDataReader.ConsumeMetaData() +33
   System.Data.SqlClient.SqlDataReader.get_MetaData() +86
   System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +311
   System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async) +987
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result) +162
   System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +32
   System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +141
   System.Data.SqlClient.SqlCommand.ExecuteDbDataReader(CommandBehavior behavior) +12
   System.Data.Common.DbCommand.System.Data.IDbCommand.ExecuteReader(CommandBehavior behavior) +10
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +144
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +319
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, String srcTable) +92
   System.Web.UI.WebControls.SqlDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments) +1618
   System.Web.UI.DataSourceView.Select(DataSourceSelectArguments arguments, DataSourceViewSelectCallback callback) +21
   System.Web.UI.WebControls.DataBoundControl.PerformSelect() +143
   System.Web.UI.WebControls.BaseDataBoundControl.DataBind() +74
   System.Web.UI.WebControls.GridView.DataBind() +4
   System.Web.UI.WebControls.BaseDataBoundControl.EnsureDataBound() +66
   System.Web.UI.WebControls.GridView.OnPreRender(EventArgs e) +26
   System.Web.UI.Control.PreRenderRecursiveInternal() +103
   System.Web.UI.Control.PreRenderRecursiveInternal() +175
   System.Web.UI.Control.PreRenderRecursiveInternal() +175
   System.Web.UI.Control.PreRenderRecursiveInternal() +175
   System.Web.UI.Control.PreRenderRecursiveInternal() +175
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2496

---

在SQL中对字符串使用相等时，需要将其括在引号中。通常为

”

。如果列类型为数字（即long、int等），则不需要引号

您还可以使用

String.Format

，这将提高可读性。例如：

String.Format（“Quarter.Quarter_Name='{0}'，DDLQuarter.SelectedValue.ToString（））；

以下是已修复字符串相等的原始代码：

 if (DDLFaculty.SelectedValue != "Select")
        {
            arrFields.Add("Employee.Employee_ID = '" + DDLFaculty.SelectedValue + "'");
        }
        if (DDLQuarter.SelectedValue != "Select")
        {
            arrFields.Add("Quarter.Quarter_Name = '" + DDLQuarter.SelectedValue + "'");
        }
        if (DDLCourse.SelectedValue != "Select")
        {
            arrFields.Add("Course.Title = '" + DDLCourse.SelectedValue + "'");
        }

---

您应该在替换后向我们提供SQL，但您的问题可能是：

• 您将获得“Quarter.Year=A”和。因为“a”后面少了一个空格
• 您正在与我猜测的值进行比较的是字符串字段（四分之一名称、课程名称），它们周围没有引号
• Join可能不会在字符串的最开头粘贴“and”

---

哪里定义了

a

（该代码看起来像是SQL注入的配方）您能否打印出您生成的导致错误的整个查询，并将其放在这里，以便我们可以看到您的查询生成的输出是什么？此外，您在用户输入之间附加SQL的方式有潜在的危险。@Kirk Woll是的，看起来确实可能会发生一些大规模SQL注入。这会留下安全漏洞吗在代码隐藏文件中的y？我发现了一个可能对您有用的链接：谢谢，您的观点非常有用。字符串.Join会添加“and”，但只有在填充第一个数组值之后。因此，我所做的是将WHERE子句更改为：（Quarter.Year=“+a+”和“+String.Join”（“and”），arrFields.ToArray（））+”；

 if (DDLFaculty.SelectedValue != "Select")
        {
            arrFields.Add("Employee.Employee_ID = '" + DDLFaculty.SelectedValue + "'");
        }
        if (DDLQuarter.SelectedValue != "Select")
        {
            arrFields.Add("Quarter.Quarter_Name = '" + DDLQuarter.SelectedValue + "'");
        }
        if (DDLCourse.SelectedValue != "Select")
        {
            arrFields.Add("Course.Title = '" + DDLCourse.SelectedValue + "'");
        }