sql查詢問題

Question

protected void Button1_Click(object sender, EventArgs e) 
{ 
    SqlConnection myConnection = new SqlConnection("Data Source=DELL-PC\\SQLEXPRESS;Initial Catalog=eclass;Persist Security Info=True;integrated security = true"); 
    myConnection.Open(); 
    string key = txtsearchkey.Text.ToString(); 

    SqlCommand q1 = new SqlCommand("select cat_id from category where cat_name='" + (ddsearchcat.SelectedItem.ToString() + "'"), myConnection); 
    string cat = q1.ExecuteScalar().ToString(); 

    SqlCommand q2 = new SqlCommand("select subcat_id from subcategory where subcat_name= '" + (ddsearchsubcat.SelectedItem.ToString() + "'"), myConnection); 
    string subcat = q2.ExecuteScalar().ToString(); 

    SqlCommand q3 = new SqlCommand("select adid from adType where adtype= '" + (ddsearchtype.SelectedItem.ToString()) + "'", myConnection); 
    string adtype = q3.ExecuteScalar().ToString(); 

    String date = ddsearchdays.SelectedItem.ToString(); 

    if (chkAdimg.Checked) 
    { 
     if (chkAdVideo.Checked) 
     { 
      SqlCommand query = new SqlCommand("select title,ad_description from postad where ad_description like " + txtsearchkey + " and category_id=" + cat + " and subcategory_id=" + subcat + " and ad_id=" + adtype + " and video is not null and img_id is not null and adType INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid CROSS JOIN category CROSS JOIN subcategory CROSS JOIN userdetails", myConnection);   

      DataSet ds = new DataSet(); 
      SqlDataAdapter ad = new SqlDataAdapter(query); 
      ad.Fill(ds); 
      foreach (DataRow dr in ds.Tables[0].Rows) 
      { 
        Response.Write(dr[0].ToString()); 
      } 
     } 
    } 
} 

這個查詢是給了我一個問題，說

其中 條件，預計在指定的上下文非布爾型 的表達，接近內心...

我應該讓我的查詢什麼變化

Answer 1

select title,ad_description from postad where ad_description like " + txtsearchkey + " and category_id=" + cat + " and subcategory_id=" + subcat + " and ad_id=" + adtype + " and video is not null and img_id is not null and adType INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid CROSS JOIN category CROSS JOIN subcategory CROSS JOIN userdetails", myConnection);  

你在哪裏使用內部連接後的條件？

我想這可能是正確的

select title,ad_description 
from postad 
INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid 
CROSS JOIN category 
CROSS JOIN subcategory 
CROSS JOIN userdetails 
where ad_description like " + txtsearchkey + " 
    and category_id=" + cat + " 
    and subcategory_id=" + subcat + " 
    and ad_id=" + adtype + " 
    and video is not null 
    and img_id is not null 

Answer 2

我以爲這是在這兒，你已經有了

...and adType INNER JOIN adType... 

你的聯接應在WHERE子句之前完成，更何況你確實應該使用參數的值而不是純文本，以避免像SQL注入的東西，你可能會需要％的值你想做一個LIKE，但我離題...

Answer 3

該varch ar列應該包含引用的值。例如

where ad_description like " + txtsearchkey + " and 

應該是

where ad_description like '" + txtsearchkey + "' and 

此外

img_id is not null and adType INNER JOIN 

應具有

img_id is not null INNER JOIN 

即ADTYPE似乎是不必要的。

這不是製作動態SQL的好方法。它不僅暴露給SQL注入，而且幾乎不可能維護。

Answer 4

你有你的WHERE條款後您的加入，它需要是WHERE條款前後FROM

select 
    title, 
    ad_description 
from postad 
INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid 
CROSS JOIN category 
CROSS JOIN subcategory 
CROSS JOIN userdetails 
where ad_description like " + txtsearchkey + " 
and category_id=" + cat + " 
and subcategory_id=" + subcat + " 
and ad_id=" + adtype + " 
and video is not null 
and img_id is not null 
and adType "