Vb.net Visual Basic 2008新搜索查询

我试图通过添加到项目中的access数据库进行搜索，但出现以下错误：System.Data.OleDb.OledBeException类型的未处理异常发生在System.Data.dll中 附加信息：没有为一个或多个必需参数提供值

其想法是在数据库中搜索输入文本框的文本，然后在更多文本框中显示该行的信息

调试时，代码dr=cmd.ExecuteReader也会被突出显示为一个问题。我使用的是visual basic 2008，对整个编码场景来说都是全新的，因此请解释为什么会出现此问题

Imports System.Windows.Forms
Imports System.Data.OleDb
Public Class frmSearch
Public con As OleDbConnection = New OleDbConnection
Public dr As OleDbDataReader

Dim dbProvider As String
Dim dbSource As String

Dim BillingSystemFolder As String
Dim TheDatabase As String
Dim FullDatabasePath As String



Private Sub frmSearch_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
    'TODO: This line of code loads data into the 'BillingdatabaseDataSet.BillingInfo' table. You can move, or remove it, as needed.
    Me.BillingInfoTableAdapter.Fill(Me.BillingdatabaseDataSet.BillingInfo)

    dbProvider = "PROVIDER=Microsoft.ACE.OLEDB.12.0;"
    'Setup the provider

    TheDatabase = "/billingdatabase.accdb"
    BillingSystemFolder = Application.StartupPath
    FullDatabasePath = BillingSystemFolder & TheDatabase
    'Set the database and the location of it

    dbSource = "Data Source = " & FullDatabasePath
    'Set the data source

    con.ConnectionString = dbProvider & dbSource
    'Set the connection string

End Sub

Private Sub btnSearch_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnSearch.Click
    con.Open()
    txtJobNum.Clear()
    txtName.Clear()
    txtSurname.Clear()
    Dim str As String
    str = "SELECT * FROM BillingInfo WHERE (Code = " & CodeText.Text & ")"
    Dim cmd As OleDbCommand = New OleDbCommand(str, con)
    dr = cmd.ExecuteReader
    While dr.Read()
        txtSurname.Text = dr("Surname").ToString
        txtName.Text = dr("First Name").ToString
        txtJobID.Text = dr("Customer ID").ToString
    End While
    con.Close()
End Sub

---

End Class

字段代码可能是一个文本字段。在这种情况下，如果要使用该字段的特定值进行搜索，应将该值括在单引号之间

像这样的

str = "SELECT * FROM BillingInfo WHERE (Code = '" & CodeText.Text & "')"

然而，这实际上是一个糟糕的做法，因为这允许创建一个报价，否则它将因为您的值包含一个报价而失败

正确的方法是使用如下参数化查询

str = "SELECT * FROM BillingInfo WHERE (Code = @p1)"
Dim cmd As OleDbCommand = New OleDbCommand(str, con)
cmd.Parameters.Add("@p1", OleDbType.VarWChar).Value =  CodeText.Text 
dr = cmd.ExecuteReader

---

不要执意进行SQL查询。使用SQL参数（）它们可以解决许多问题。

整个编码场景

它是一个场景？在这里，我认为它是一种职业