2014-11-06 24 views
-2

對於以下代碼,我在執行之前不知道列表框項目,因此我需要動態查詢選擇以下代碼;需要對以下代碼進行動態插入查詢

  string selectedTable = cmbImportItemList.Text; 

      string col1 = opLstCsl3.Items[0].ToString(); 
      string col2 = opLstCsl3.Items[1].ToString(); 
      string col3 = opLstCsl3.Items[2].ToString(); 
      string col4 = opLstCsl3.Items[3].ToString(); 
      string col5 = opLstCsl3.Items[4].ToString(); 
      string col6 = opLstCsl3.Items[5].ToString(); 
      string col7 = opLstCsl3.Items[6].ToString(); 
      string col8 = opLstCsl3.Items[7].ToString(); 
      //string[] coll = new string[100]; 
      //string col9 = opLstCsl3.Items[8].ToString(); 
      //'"+col1+"','"+col2+"','"+col3+"','"+col4+"' 
      using (SqlDataAdapter adater = new SqlDataAdapter("Select " + col1 + "," + col2 + "," + col3 + "," + col4 + "," + col5 + "," + col6 + "," + col7 + "," + col8 + " from " + selectedTable, new SqlConnection(Properties.Settings.Default.connectionstring2))) 
      { 
       adater.Fill(dttt); 
      } 
+3

你應該總是使用[參數化查詢(http://blog.codinghorror.com /給-ME-參數-SQL或放棄的我死亡/)。這種字符串連接對於[SQL注入](http://en.wikipedia.org/wiki/SQL_injection)攻擊是開放的。 – 2014-11-06 07:22:33

+0

使用存儲過程會容易得多! – 2014-11-06 07:23:20

+0

你可以給我一些指導,關於編寫存儲過程相同的查詢 – 2014-11-06 07:26:19

回答

0

我寫了一個存儲過程的查詢,首先在數據庫中執行此,

CREATE PROCEDURE GetData @colName nvarchar(500) = NULL,@tableName nvarchar(50)=NULL 
AS 
DECLARE @sqlText nvarchar(1000); 
SET @sqlText = N'SELECT ' + @colName + ' FROM ' + @tableName 
Exec (@sqlText) 
GO 

,讓你列用逗號分隔的像下面

string selectedTable = cmbImportItemList.Text; 
string columns = string.Empty; 
foreach (var item in pLstCsl3.Items) 
{ 
    columns += item + ','; 
} 

最後請撥打存儲過程如下,

using (SqlConnection con = new SqlConnection(Properties.Settings.Default.connectionstring2)) { 
    con.Open(); 

    SqlCommand cmd = new SqlCommand("GetData", con); 
    cmd.CommandType = CommandType.StoredProcedure; 
    cmd.Parameters.Add(new SqlParameter("@colName", columns)); 
    cmd.Parameters.Add(new SqlParameter("@tableName", selectedTable)); 

    using (SqlDataReader rdr = cmd.ExecuteReader()) { 

     while (rdr.Read()) 
     { 
      // do what ever you want with your records. 
     } 
    } 
} 

希望它可以幫助

如果你想了解有關存儲過程的參考以下鏈接, http://www.codeproject.com/Articles/126898/Sql-Server-How-to-write-a-Stored-procedure-in-Sql

感謝 斯萬

+0

非常感謝你先生...我會試試這個... – 2014-11-06 11:48:09

+0

如果它適合你,標記這是一個答案,謝謝。 – 2014-11-06 11:50:00