2011-07-22 57 views
0

我正在使用ASP.NET Razor。CSHTML - SQL QUERY .... WHERE NAME = @ NameOne

<form style="display:inline" name="formular1" method="post" action="default.cshtml"> 
          <select name="phone1" class="dropdown"> 
          @foreach(var row in db.Query("SELECT * FROM Handy")){ 
       <option value="@row.Handyname">@row.Handyname</option> 
      } 
             </select> 
     vs. 
          <select name="phone2" class="dropdown"> 
              @foreach(var row in db.Query("SELECT * FROM Handy")){ 
       <option value="@row.Handyname">@row.Handyname</option> 
      } 
             </select> 
     <input type="submit"/ value="Compare"> 
     </form> 
     @{ 
      var phoneOne = ""; 
      var phoneTwo = ""; 
        if(IsPost){ 

         // request input of the select forms 
         phoneOne = Request["phone1"]; 
         phoneTwo = Request["phone2"]; 
        } 
       }          
    </div> 

    <div class="content"> 
     <div class="start"> 
      <p><h2>@phoneOne</h2></p> 
      <ul> 
      @{ 
       if(IsPost){ 
        foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")){ 
       <li>processor: @row.Prozessor GHz</li> 
       <li>memory: @row.RAM MB Ram</li> 
       <li>weight: @row.Gewicht g</li> 
       <li>display: @row.Display ''</li> 
       <li>OS: @row.OS</li> 
      } 
       } 
      } 


      </ul> 
     </div> 

獲取查詢錯誤:WHERE Handyname = @ phoneOne ...把​​它們全部正常工作。我究竟做錯了什麼?

謝謝:)!

+0

什麼是錯誤? SQL錯誤還是Razor? – GalacticCowboy

回答

1

還不是很確定,但我認爲你需要更換此:

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")) 

有了這個:

foreach(var row in db.Query("SELECT * FROM Handy WHERE Handyname= " + phoneOne)) 
+1

如果你採用這種方式,你需要非常小心地防止[SQL注入攻擊](http://en.wikipedia.org/wiki/SQL_injection)。 –

1

如上所述here,請嘗試以下操作:

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]@phoneOne")){ 
0

是db Razor中對數據庫組件的引用?如果是這樣,它使用@ 0,@ 1,(索引)而不是命名參數。

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")) 

並通過該方法中的參數集合傳遞值。