無效的列名工作正常

Question

當我PatientId它工作正常更換EmerPacienti，爲什麼發生？

if (DropDownList3.SelectedItem.Value == "In-Pacient") 
{ 
    SqlDataAdapter Da = new SqlDataAdapter("select * from Ipacient where EmerPacienti=" + TextBox11.Text + "", cn); 
    //SqlCommandBuilder Cmd = new SqlCommandBuilder(Da); 
    DataSet Ds = new DataSet(); 
    Da.Fill(Ds, "Ipacient"); 
    GridView1.DataSource = Ds.Tables[0]; 
    GridView1.DataBind(); 

Answer 1

使用sql參數來防止sql注入，那麼你也不需要把它包裝在文本列所需的撇號中。因此，這是好多了：

using (var cn = new SqlConnection("insert connection string")) 
using(var da = new SqlDataAdapter("select * from Ipacient where EmerPacienti=@EmerPacienti", cn)) 
{ 
    da.SelectCommand.Parameters.Add("@EmerPacienti", SqlDbType.VarChar).Value = TextBox11.Text; 
    DataTable table = new DataTable(); 
    da.Fill(table); 
    GridView1.DataSource = table; 
    GridView1.DataBind(); 
} 

如果它是一個int - 值使用int.Parse/int.TryParse：

using (var cn = new SqlConnection("insert connection string")) 
using(var da = new SqlDataAdapter("select * from Ipacient where PatientId=@PatientId", cn)) 
{ 
    int patientId; 
    if (int.TryParse(TextBox11.Text, out patientId)) 
    { 
     da.SelectCommand.Parameters.Add("@PatientId", SqlDbType.Int).Value = patientId; 
     // ... 
    } 
}