將查詢轉換爲參數化的asp.net查詢

Question

我該如何進行參數化？

string query = ""; 

      query += " SELECT DistID FROM Distributor"; 
      query += " WHERE Username = '" + username_id.Text + "'"; 
      query += " AND Password = '" + password.Text + "'"; 

      GeneralFunctions.GetData(query); 

可以在這裏完成，還是必須在GetData方法內完成？

這裏有兩種方法：

public static DataTable GetData (string query) 
{ 
    SqlDataAdapter dataAdapter; 
    DataTable table; 

    try 
    { 
     dataAdapter = new SqlDataAdapter(query, GetConnectionString()); 
     table = new DataTable(); 

     dataAdapter.Fill(table); 
     return table; 
    } 
    catch (Exception ex) 
    { 
    } 
    finally 
    { 
     dataAdapter = null; 
     table = null; 
    } 

    return table; 
} 

public static string GetConnectionString() 
{ 
    string connectionString = ConfigurationManager.ConnectionStrings[ "CAPortalConnectionString" ].ConnectionString; 

    return connectionString; 
} 

Answer 1

我建議你設計特定的方法來查詢數據庫，如：

public static int? GetDistID(string username, string password) 
{ 
    using (var conn = new SqlConnection(GetConnectionString())) 
    using (var cmd = conn.CreateCommand()) 
    { 
     conn.Open(); 
     cmd.CommandText = 
     @"SELECT 
       DistID 
      FROM 
       Distributor 
      WHERE 
       Username = @username 
      AND 
       Password = @password"; 
     cmd.Parameters.AddWithValue("@username", username); 
     cmd.Parameters.AddWithValue("@password", password); 
     using (var reader = cmd.ExecuteReader()) 
     { 
      if (!reader.Read()) 
      { 
       // no results found 
       return null; 
      } 
      return reader.GetInt32(reader.GetOrdinal("DistID")); 
     } 
    } 
} 

然後：

var distId = GeneralFunctions.GetDistID(username_id.Text, password.Text); 

不需要DataTables/Sets/Adapters。使用強類型對象。

Answer 2

使用SqlCommand對象，你可以這樣創建一個參數化查詢：

public object GetDistID(string username, string password) 
{ 
    using (var conn = new SqlConnection("...")) 
    { 
     using (var cmd = new SqlCommand("SELECT DistID FROM Distributor WHERE Username=@Username AND Password=@Password", conn)) 
     { 
      cmd.Connection.Open(); 
      cmd.Parameters.AddWithValue("@Username", username); 
      cmd.Parameters.AddWithValue("@Password", password);     
      return cmd.ExecuteScalar(); 
     } 
    } 
} 

如果這是對你有用，這裏是你可以使用一個類。它是對存儲過程量身定做的，但它應該是很容易的添加接受查詢的方法：

using System; 
using System.Data; 
using System.Data.SqlClient; 
using System.Configuration; 
using System.Web; 
using System.Xml; 
using System.Collections; 
using System.Collections.Specialized; 
using System.Collections.Generic; 
using System.Text; 

namespace NESCTC.Data 
{ 
    public class DataAccess : IDisposable 
    { 
     #region declarations 

     private SqlCommand _cmd; 
     private string _SqlConnString; 

     #endregion 

     #region constructors 

     public DataAccess(string ConnectionString) 
     { 
      _cmd = new SqlCommand(); 
      _cmd.CommandTimeout = 240; 
      _SqlConnString = ConnectionString; 
     } 

     #endregion 

     #region IDisposable implementation 

     ~DataAccess() 
     { 
      Dispose(false); 
     } 

     public void Dispose() 
     { 
      Dispose(true);    
     } 

     protected virtual void Dispose(bool disposing) 
     { 
      if (disposing) 
      { 
       _cmd.Connection.Dispose(); 
       _cmd.Dispose(); 
      } 
     } 

     #endregion 

     #region data retrieval methods 

     public DataTable ExecReturnDataTable() 
     { 
      using (SqlConnection conn = new SqlConnection(this.ConnectionString)) 
      { 
       try 
       { 
        PrepareCommandForExecution(conn); 
        using (SqlDataAdapter adap = new SqlDataAdapter(_cmd)) 
        { 
         DataTable dt = new DataTable(); 
         adap.Fill(dt); 
         return dt; 
        } 
       } 
       catch 
       { 
        _cmd.Connection.Close(); 
        throw; 
       } 
       finally 
       { 
        _cmd.Connection.Close(); 
       } 
      } 
     }  

     public object ExecScalar() 
     { 
      using (SqlConnection conn = new SqlConnection(this.ConnectionString)) 
      { 
       try 
       { 
        PrepareCommandForExecution(conn); 
        return _cmd.ExecuteScalar(); 
       } 
       catch (Exception ex) 
       { 
        _cmd.Connection.Close(); 
        throw ex; 
       } 
       finally 
       { 
        _cmd.Connection.Close(); 
       } 
      } 
     }     

     #endregion 

     #region data insert and update methods 

     public void ExecNonQuery() 
     { 
      using (SqlConnection conn = new SqlConnection(this.ConnectionString)) 
      { 
       try 
       { 
        PrepareCommandForExecution(conn); 
        _cmd.ExecuteNonQuery(); 
       } 
       catch 
       { 
        _cmd.Connection.Close(); 
        throw; 
       } 
       finally 
       { 
        _cmd.Connection.Close(); 
       } 
      } 
     } 

     #endregion 

     #region helper methods 

     public void AddParm(string ParameterName, SqlDbType ParameterType, object Value) 
     { _cmd.Parameters.Add(ParameterName, ParameterType).Value = Value; } 

     private SqlCommand PrepareCommandForExecution(SqlConnection conn) 
     { 
      try 
      { 
       _cmd.Connection = conn; 
       _cmd.CommandType = CommandType.StoredProcedure; 
       _cmd.CommandTimeout = this.CommandTimeout; 
       _cmd.Connection.Open(); 

       return _cmd; 
      } 
      catch 
      { 
       _cmd.Connection.Close(); 
       throw; 
      } 
     } 

     #endregion 

     #region properties 

     public int CommandTimeout 
     { 
      get { return _cmd.CommandTimeout; } 
      set { _cmd.CommandTimeout = value; } 
     } 

     public string ProcedureName 
     { 
      get { return _cmd.CommandText; } 
      set { _cmd.CommandText = value; } 
     } 

     public string ConnectionString 
     { 
      get { return _SqlConnString; } 
      set { _SqlConnString = value; } 
     } 

     #endregion 
    } 
} 

您可以使用類是這樣的：

public object GetDistID(string username, string password) 
{ 
    using (var data = new DataAccess("ConnectionString")) 
    { 
     data.ProcedureName = "GetDistID"; 
     data.AddParm("@Username", SqlDbType.VarChar, username); 
     data.AddParm("@Password", SqlDbType.VarChar, password); 
     return data.ExecScalar(); 
    } 
}