SqlExecuteCommand附近有語法錯誤=

Question

我有這樣的方法：

public int GetPreferredRoomID(String roomCategory) 
{ 
    int RoomId; 
    return RoomId = db.Database.ExecuteSqlCommand("SELECT RoomId FROM dbo.Rooms WHERE RoomCategory = " + roomCategory); 
} 

，但我得到它說語法不正確附近=

Answer 1

不能賦值給變量和一行返回的錯誤信息。你需要兩條語句。你還必須用撇號包裝文本列。

RoomId = db.Database.ExecuteSqlCommand("SELECT RoomId FROM dbo.Rooms WHERE RoomCategory = '" + roomCategory + "'"); 
return RoomId; 

但是，看起來好像您打開了sql-injection。改用參數化查詢。

Answer 2

在SQL語句中，您需要爲字符串值添加單引號。

正確的方式做到這一點之前和之後roomCategory

只是添加單引號這裏是正確的答案。

public int GetPreferredRoomID(String roomCategory) 
{ 
    int RoomId; 
    return RoomId = db.Database.ExecuteSqlCommand("SELECT RoomId FROM dbo.Rooms WHERE RoomCategory = '" + roomCategory +"'"); 
}