將數據類型varchar轉換爲浮動填充GridView時出錯Error

Question

我使用以下代碼在放入文本框並單擊按鈕的數字數據的基礎上填充GridView。 但它給出了以下錯誤。 將數據類型varchar轉換爲float時出錯。 由於我的數據庫列'matri_perct'有數據類型'浮動'。

protected void Button1_Click(object sender, EventArgs e) 
    { 
     try 
     { 
      con = new SqlConnection(ConfigurationManager.ConnectionStrings["SQL Connection String"].ConnectionString);con.Open(); 
     com = new SqlCommand("SELECT * FROM stdtable WHERE matri_perct > @Percent", con); 
     com.Parameters.AddWithValue("Percent", float.Parse(txtPercent.Text)); 
     com.ExecuteNonQuery(); 
      SqlDataAdapter dataadapter = new SqlDataAdapter(); 
      DataSet ds = new DataSet(); 
      dataadapter.Fill(ds, "Data"); 
      GridView1.DataSource = ds; 
      GridView1.DataMember = "Data"; 
      con.Close(); 
     } 
     catch (System.Exception err) 
     { 
      Label1.Text = err.Message.ToString(); 
     } 
    } 

我的GridView的.aspx代碼被聲明爲

<asp:GridView ID="GridView1" runat="server" AllowPaging="True" AutoGenerateColumns="False" DataKeyNames="univ_regno" DataSourceID="" EnableModelValidation="True"> 
    <Columns> 
     <asp:BoundField DataField="school" HeaderText="School" 
      SortExpression="school" /> 
     <asp:BoundField DataField="univ_regno" HeaderText="Univ R.No." ReadOnly="True" 
      SortExpression="univ_regno" /> 
     <asp:BoundField DataField="colge_rollno" HeaderText="Coll. R.No." 
      SortExpression="colge_rollno" /> 
     <asp:BoundField DataField="branch" HeaderText="Branch" 
      SortExpression="branch" /> 
     <asp:BoundField DataField="sem" HeaderText="Sem" SortExpression="sem" /> 
     <asp:BoundField DataField="name" HeaderText="Name" SortExpression="name" /> 
     <asp:BoundField DataField="f_name" HeaderText="F.Name" 
      SortExpression="f_name" /> 
     <asp:BoundField DataField="date_birth" HeaderText="DOB" 
      SortExpression="date_birth" /> 

     <asp:BoundField DataField="mob" HeaderText="Mobile" 
      SortExpression="mob" /> 
     <asp:BoundField DataField="email" HeaderText="E-mail" SortExpression="email" /> 
     <asp:BoundField DataField="matri_perct" HeaderText="Matric %" 
      SortExpression="matri_perct" /> 
     <asp:BoundField DataField="intermed_perct" HeaderText="Intermediate %" 
      SortExpression="intermed_perct" /> 
     <asp:BoundField DataField="grad_perct" HeaderText="UG %" 
      SortExpression="grad_perct" /> 
     <asp:BoundField DataField="post_grad_perct" HeaderText="PG %" 
      SortExpression="post_grad_perct" /> 
     <asp:BoundField DataField="other_perct" HeaderText="Other %" 
      SortExpression="other_perct" /> 
     <asp:BoundField DataField="no_backlogs" HeaderText="Backlogs" 
      SortExpression="no_backlogs" /> 
     <asp:BoundField DataField="Password" HeaderText="Password" 
      SortExpression="Password" /> 
    </Columns> 
</asp:GridView> 
    <asp:SqlDataSource ID="studentprofile" runat="server" 
     ConnectionString="<%$ ConnectionStrings:SQL Connection String %>" 

     SelectCommand="SELECT DISTINCT [school], [univ_regno], [colge_rollno], [branch], [sem], [name], [f_name], [date_birth], [cores_add], [mob], [email], [matri_perct], [intermed_perct], [grad_perct], [post_grad_perct], [other_perct], [no_backlogs], [Password] FROM [stdtable] ORDER BY [branch], [univ_regno]"> 
    </asp:SqlDataSource> 

Answer 1

我已經解決了我的問題與@Bob考夫曼& @rene 我的問題的完整解決方案的幫助下以下幾點：

protected void Button1_Click(object sender, EventArgs e) 
{ 
    try 
    { 

     con = new SqlConnection(ConfigurationManager.ConnectionStrings["SQL Connection String"].ConnectionString); 
     con.Open(); 
     com = new SqlCommand("SELECT * FROM stdtable WHERE matri_perct > @Percent", con); 
     com.Parameters.AddWithValue("@Percent", float.Parse(txtPercent.Text)); 
     SqlDataReader reader = com.ExecuteReader(); // execute SELECT statement, store result in data reader 
     GridView1.DataSource = reader; 
     GridView1.DataBind(); 
     con.Close(); 
     } 
    catch (System.Exception err) 
    { 
     Label1.Text = err.Message.ToString(); 
    } 
} 

然後，我已經改變了AllowPaging =假

它作品;）

Answer 2

首先，進入構建在劉若英的回答使用parameters一樣，而不是通過拼接SQL語句的習慣。您將以這種方式避免很多問題（例如，SQL注入攻擊，帶有轉義字符的字符串會破壞SQL語句）。

其次，如果matri_perct是float，正確的語法是：

com = new SqlCommand("SELECT * FROM stdtable WHERE matri_perct > " + 
    float.Parse(txtPercent.Text) + ", con); 

沒有singlequotes或百分號。

正如我所說，不要直接複製到您的生產代碼！，而是將用戶輸入轉換爲參數。試想，如果一個user進入

0); DROP TABLE Students; -- 

到您的文本會發生什麼。

編輯

此代碼是一個有點混亂，對我說：

com.ExecuteNonQuery(); // looks like you're running the SELECT statement then discarding the result 
SqlDataAdapter dataadapter = new SqlDataAdapter(); 
DataSet ds = new DataSet(); 
dataadapter.Fill(ds, "Data"); // I don't see how this gets the data from your query, above. 
GridView1.DataSource = ds; 
GridView1.DataMember = "Data"; // see my change, below. 

這個怎麼樣，而不是（請留下你們的前三行原封）：

SqlDataReader reader = com.ExecuteReader(); // execute SELECT statement, store result in data reader 
SqlDataAdapter adapter = new SqlDataAdapter(); 
adapter.Fill(reader); 
GridView1.DataSource = adapter; 
GridView1.DataBind(); 

Answer 3

讓的SqlClient舉重：

com = new SqlCommand("SELECT * FROM stdtable WHERE matri_perct > @percent", con); 
    com.Parameters.AddWithValue("percent", float.Parse(txtPercent.Text)); 
    com.ExecuteNonQuery(); 

或者，如果你想更具體的瞭解了sqlparameter type：

com = new SqlCommand("SELECT * FROM stdtable WHERE matri_perct > @percent", con); 
var percentParam = new SqlParameter("percent", SqlDbType.Float); 
percentParam.Value = txtPercent.Text; 
com.Parameters.Add(percentParam); 

更重要的是：一定要使用參數（如由Bob指出的），而不是字符串連接，否則你會發現沿途的麻煩。