在asp.net中根據會話變量提取兩個日期之間的數據

Question

它是一個基於日期的搜索頁面，根據會話前綴值選擇表名。但是它給出錯誤爲無效列名'ALV' 。 'ALV'是前綴值之一。

protected void Button1_Click(object sender, EventArgs e) 
    { 
     DateTime fromDate; 
     DateTime toDate; 

     if (DateTime.TryParse(txtFrom.Text, out fromDate) && DateTime.TryParse(txtTo.Text, out toDate)) 
     { 

      if (DropDownList1.SelectedItem.Text == "RouteToGrowth") 
      { 


       SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConStr"].ToString()); 
       con.Open(); 
       string Prefix = Session["Prefix"].ToString(); 
       string SqlStatement1 = " select ActionID,rid ,h.UserID,h.Date,h.Tablename,h.Feedback,h.Status from history h,LoginTable l where l.UserId=h.UserID and h.Tablename='RouteToGrowthRecord_st' and l.Prefix=" + Prefix + " and date between @from and @to "; 
       SqlCommand cmd1 = new SqlCommand(SqlStatement1, con); 
       cmd1.Parameters.Add("@from", SqlDbType.Date).Value = fromDate; 
       cmd1.Parameters.Add("@to", SqlDbType.Date).Value = toDate; 
       cmd1.Parameters.Add("@Prefix", SqlDbType.VarChar).Value = Prefix; 
       cmd1.CommandType = CommandType.Text; 
       cmd1.ExecuteNonQuery(); 
       GridView1.DataBind(); 
       con.Close(); 
      } 
     } 
     else 
     { 
      ClientScript.RegisterStartupScript(Page.GetType(), "validation", "<script language='javascript'>alert('Please fill the data correctly')</script>"); 
     } 
} 

Answer 1

不應該sqlstatement不帶參數嗎？

string SqlStatement1 = "select ActionID,rid ,h.UserID,h.Date,h.Tablename,h.Feedback,h.Status from history h,LoginTable l where l.UserId=h.UserID and h.Tablename='RouteToGrowthRecord_st' and l.Prefix=@Prefix and date between @from and @to ";