SQL參數格式問題

Question

在我的C＃MVC4應用程序，我有以下代碼：上線

string[] parameters = new string[items.Count]; 
      SqlCommand SecondQuery = new SqlCommand(); 
      for (int i = 0; i < items.Count; i++) 
      { 
       parameters[i] = string.Format(items[i].Id); 
       SecondQuery.Parameters.AddWithValue(parameters[i], items[i]); 
      } 
      SecondQuery.CommandText = string.Format("SELECT * from S_analysis WHERE heat_no IN ({0})", string.Join(", ", parameters)); 
      SecondQuery.Connection = new SqlConnection(strSQLconnection); 
      using (SqlConnection conn = new SqlConnection(strSQLconnection)) 
      { 
       SecondQuery.CommandTimeout = 50000; 
       conn.Open(); 
       SecondQuery.Connection = new SqlConnection(strSQLconnection); 
       SecondQuery.Connection.Open(); 

       using (var reader7 = SecondQuery.ExecuteReader()) 
       { 
        int fieldCount = reader7.FieldCount; 

        while (reader7.Read()) 
        { 
         for (int i = 0; i < fieldCount; i++) 
         { 
          finalresults.Add(reader7[i].ToString()); 
         } 
        } 
       } 
      } 

我的應用程序崩潰：using (var reader7 = SecondQuery.ExecuteReader())與此錯誤：No mapping exists from object type <>f__AnonymousType42[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089],[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]] to a known managed provider native type.

林假設這是因爲當我查看我的SecondQuery.CommandText我的查詢如下所示：SecondQuery.CommandText = "SELECT * from S_analysis WHERE heat_no IN (B5P5649, B5P5647, B5P5656, A5P0761, A5P0762)"我相信代碼的IN部分中的每個參數應該在每一邊都有單引號符號。我如何修改我的代碼來添加這個或是這是什麼導致我的錯誤？

Answer 1

你說得對，字符串值需要引用SQL Server。

string.Join(", ", parameters) 

有很多選擇，但是這會工作如果這是唯一的問題

"'"+string.Join(",", parameters).Replace(",", "','")+"'" 

然而，在代碼中的bug也越來越廣泛。您試圖參數化每個項目 - 這是行不通的，因爲在CommandText中無處指定佔位符。你所擁有的只是靜態的IN列表。你也有更多的SqlConnection實例。

 string[] parameters = new string[items.Count]; 
     SqlCommand SecondQuery = new SqlCommand(); 
     for (int i = 0; i < items.Count; i++) 
     { 
      parameters[i] = "'" + string.Format(items[i].Id) + "'"; 
      //SecondQuery.Parameters.AddWithValue(parameters[i], items[i]); 
     } 
     SecondQuery.CommandText = string.Format("SELECT * from S_analysis WHERE heat_no IN ({0})", string.Join(",", parameters)); 
     using (SqlConnection conn = new SqlConnection(strSQLconnection)) 
     { 
      SecondQuery.CommandTimeout = 50000; 
      conn.Open(); 
      SecondQuery.Connection = conn; 

      using (var reader7 = SecondQuery.ExecuteReader()) 
      { 
       int fieldCount = reader7.FieldCount; 

       while (reader7.Read()) 
       { 
        for (int i = 0; i < fieldCount; i++) 
        { 
         finalresults.Add(reader7[i].ToString()); 
        } 
       } 
      } 
     }