2017-04-12 25 views

回答

-1

,我們要做的就是在SQL是做到以下幾點:

Select * from table where 
    (ISNULL(@field1, '') = '' OR @field1 = table.field1) 
    and (ISNULL(@field2, '') = '' OR @field2 = table.field2) 
    and (ISNULL(@field3, '') = '' OR @field3 = table.field3) 
    and (ISNULL(@field4, '') = '' OR @field4 = table.field4) 
    and (ISNULL(@field5, '') = '' OR @field5 = table.field5) 
    and (ISNULL(@field6, '') = '' OR @field6 = table.field6) 

或VB

dim sql as string = "Select * from table where 
    (ISNULL(" & textBobx1.text & ", '') = '' OR " & textBobx1.text & "= table.field1) 
    and (ISNULL(" & textBobx2.text & ", '') = '' OR " & textBobx2.text & "= table.field2) 
    and (ISNULL(" & textBobx3.text & ", '') = '' OR " & textBobx3.text & "= table.field3) 
    and (ISNULL(" & textBobx4.text & ", '') = '' OR " & textBobx4.text & "= table.field4) 
    and (ISNULL(" & textBobx5.text & ", '') = '' OR " & textBobx5.text & "= table.field5) 
    and (ISNULL(" & textBobx6.text & ", '') = '' OR " & textBobx6.text & "= table.field6)" 

你只需要通過確保如果窗體上的字段是通過各個領域沒有填寫通過空白或可以調用函數,你傳遞文本框中的文本,它返回NULL。

+0

這是開放的SQL注入。你應該**總是**使用參數。 – Bugs

+0

謝謝你的回答我剛剛添加了幾個單引號,它工作得很好! – kot

相關問題