對於以下代碼,我在執行之前不知道列表框項目,因此我需要動態查詢選擇以下代碼;需要對以下代碼進行動態插入查詢
string selectedTable = cmbImportItemList.Text;
string col1 = opLstCsl3.Items[0].ToString();
string col2 = opLstCsl3.Items[1].ToString();
string col3 = opLstCsl3.Items[2].ToString();
string col4 = opLstCsl3.Items[3].ToString();
string col5 = opLstCsl3.Items[4].ToString();
string col6 = opLstCsl3.Items[5].ToString();
string col7 = opLstCsl3.Items[6].ToString();
string col8 = opLstCsl3.Items[7].ToString();
//string[] coll = new string[100];
//string col9 = opLstCsl3.Items[8].ToString();
//'"+col1+"','"+col2+"','"+col3+"','"+col4+"'
using (SqlDataAdapter adater = new SqlDataAdapter("Select " + col1 + "," + col2 + "," + col3 + "," + col4 + "," + col5 + "," + col6 + "," + col7 + "," + col8 + " from " + selectedTable, new SqlConnection(Properties.Settings.Default.connectionstring2)))
{
adater.Fill(dttt);
}
你應該總是使用[參數化查詢(http://blog.codinghorror.com /給-ME-參數-SQL或放棄的我死亡/)。這種字符串連接對於[SQL注入](http://en.wikipedia.org/wiki/SQL_injection)攻擊是開放的。 – 2014-11-06 07:22:33
使用存儲過程會容易得多! – 2014-11-06 07:23:20
你可以給我一些指導,關於編寫存儲過程相同的查詢 – 2014-11-06 07:26:19