Asp.Net SQL刪除語句

我有一個Asp.net應用程序，如果用戶通過網絡提交請求，但我似乎無法讓它工作，我試圖從我的'用戶'數據庫中刪除一行。Asp.Net SQL刪除語句

HTML

<div class="panel panel-danger"> 
    <div class="panel-heading"> 
     <h3 class="panel-title">Remove User</h3> 
    </div> 
    <div class="panel-body"> 
     <asp:Label ID="lbRemoveUser" runat="server" Text="Remove User"> 
      <b>Enter Full Name</b> 
     </asp:Label>      
     <asp:TextBox runat="server" ID="txtRemoveUser" CssClass="form-control" AutoPostBack="true" OnTextChanged="txtRemoveUser_TextChanged" /> 
     <asp:Label ID="removeUserNotExist" runat="server" Text="The user entered does not exist." Visible="false" style="color: red"></asp:Label> 
    </div> 
    <div class="panel-footer"> 
     <div class="text-center"> 
      <asp:Button CssClass="btn btn-danger" ID="btnSubmitRemoveUser" runat="server" Text="Remove User" ToolTip="Click to remove the user from the list." OnClick="removeUserSubmitButton_Click" /> 
     </div> 
    </div> 
</div> 

<!-- Confirm Removal Modal--> 
<div class="modal fade" id="confirmRemoveUserModal"> 
    <div class="modal-dialog" style="margin-top: 55px"> 
     <div class="modal-content"> 
      <div class="modal-header ConfirmHeader"> 
       <h4 class="modal-title" id="myModalLabel">Confirm Removal</h4> 
      </div> 
      <div class="modal-body"> 
       <p>Are you sure you want to remove <b><%=Session["txtRemoveUser"] %></b> from the payday lunch list?</p> 
       <p>If you don't, click 'No' and the user will not be removed.</p> 
      </div> 
      <div class="modal-footer ConfirmFooter"> 
       <asp:Button id="btnRemoveConfirmYes" runat="server" CssClass="btn btn-success" Text="Yes" OnClick="btnRemoveConfirmYes_Click" ToolTip="Click to remove the user from the payday lunch list." /> 
       <asp:Button id="btnRemoveConfirmNo" runat="server" CssClass="btn btn-warning" Text="No" OnClick="btnAllCloses_Click" ToolTip="Click to close this screen. The user will not be removed." /> 
      </div> 
     </div> 
    </div> 
</div>

代碼我試圖

public void btnRemoveConfirmYes_Click(object sender, EventArgs e) 
    { 
     string connection = ConfigurationManager.ConnectionStrings["PaydayLunchConnectionString1"].ConnectionString; 
     SqlConnection conn = new SqlConnection(connection); 

     conn.Open(); 
     SqlCommand cmd1 = new SqlCommand("DELETE FROM Users WHERE Name = " + txtRemoveUser.Text, conn); 
     conn.Close(); 

     txtRemoveUser.Text = ""; 
     Response.Redirect("/AdminSide/TaskList.aspx"); 
    }

就像我說我要的是，如果它在我的數據庫中存在刪除該條目。我已經有一個檢查，以確保該條目存在於'用戶'表

我是否需要SqlDataReader rd1 = cmd1.ExecuteReader();當我嘗試它，我得到一個服務器錯誤「System.Data.SqlClient.SqlException：無效的列名稱'Test2的'。」

來源

2015-12-18 murday1983

您只需要'ExecuteNonQuery'並且更重要的是，需要使用[參數化查詢]（http://blog.codinghorror.com/give-me-parameterized-sql-or-give-me-death/）。這種字符串連接對於[SQL注入]（http://en.wikipedia.org/wiki/SQL_injection）攻擊是開放的。 –

您未使用ExecuteNonQuery。你還必須包裝用戶名撇號：

SqlCommand cmd1 = new SqlCommand("DELETE FROM Users WHERE Name = '" + txtRemoveUser.Text + "'", conn);

但是，你應該始終使用 SQL參數以防止SQL注入和其他問題：

using(var cmd1 = new SqlCommand("DELETE FROM Users WHERE Name = @Name", conn)) 
{ 
    cmd1.Parameters.Add("@Name", SqlDbType.VarChar).Value = txtRemoveUser.Text; 
    conn.Open(); 
    cmd1.ExecuteNonQuery(); 
}

也使用using語句來實施IDisposable類似SqlCommand或更重要的SqlConnection以確保處理非託管資源。

來源

2015-12-18 13:26:37

不要以爲你也可以幫助我http://stackoverflow.com/questions/34357484/asp-net-sql-update-statement – murday1983

Asp.Net SQL刪除語句

回答

相關問題