oledbException是未處理的錯誤appering

Question

我試圖填充一個文本框，使用下面的代碼的名字及姓氏：

using (OleDbConnection connName = new OleDbConnection(strCon)) 
      { 

       String sqlName = "SELECT forename, Surname FROM customer WHERE [customerID]=" + txtCustomerID.Text; 

       // Create a command to use to call the database. 
       OleDbCommand commandname = new OleDbCommand(sqlName, connName); 
       connName.Open(); 
       // Create a reader containing the results 


       using (OleDbDataReader readerName = commandname.ExecuteReader()) 
       { 
        readerName.Read(); // Advance to the first row. 
        txtName.Text = readerName[0].ToString(); 
       } 
       connName.Close();     

      } 

不過，我發現了錯誤：OleDbException了未處理。

"no required values for one of more required parameters"

在ExecuteReader我不知道如何去解決這個問題。

編輯：下面的代碼幾乎是完全相同的查詢中的信息欄，但這個例外是不會爲它。

string strCon = Properties.Settings.Default.PID2dbConnectionString; 

     using (OleDbConnection conn = new OleDbConnection(strCon)) 
     { 
      String sqlPoints = "SELECT points FROM customer WHERE [customerID]=" + txtCustomerID.Text; 
      conn.Open(); 

      // Create a command to use to call the database. 
      OleDbCommand command = new OleDbCommand(sqlPoints, conn); 
      // Create a reader containing the results 

      using (OleDbDataReader reader = command.ExecuteReader()) 
      { 
       reader.Read(); // Advance to the first row. 
       txtPoints.Text = reader[0].ToString(); // Read the contents of the first column 
      } 
      conn.Close(); 
     } 

Answer 1

通常的原因是空或空字符串即txtCustomerID.Text沒有價值，因此查詢發送到服務器：

SELECT forename, Surname FROM customer WHERE [customerID]= 

你能避免這樣和SQL Injection錯誤，堅決使用鍵入參數並避免使用參數化查詢進行數據截斷（我假定客戶ID是int字段）

using (OleDbConnection connName = new OleDbConnection(strCon)) 
    { 
     String sqlName = "SELECT forename, Surname FROM customer WHERE customerID = @CustomerID"; 

     // Create a command to use to call the database. 
     using (OleDbCommand commandname = new OleDbCommand(sqlName, connName)) 
     { 

      //Check the input is valid 
      int customerID = 0; 
      if (!int.TryParse(txtCustomerID.Text, out customerID)) 
      { 
       txtName.Text = "Customer ID Text box is not an integer"; 
       return; 
      } 


      connName.Open(); 

      // Add the parameter to the command 
      commandname.Parameters.Add("@CustomerID", OleDbType.Integer).Value = customerID; 

      // Create a reader containing the results 
      using (OleDbDataReader readerName = commandname.ExecuteReader()) 
      { 
       readerName.Read(); // Advance to the first row. 
       txtName.Text = readerName[0].ToString(); 
      } 
      connName.Close();     
     } 
    } 

Answer 2

您必須對字符串查詢中使用的參數進行編碼。

String sqlName = String.Format("SELECT forname, Surname FROM customer WHERE customerID={0}",txtCustomerID.Text); 

但我建議你不要在字符串中使用硬編碼的SQL查詢。它是SQL注入攻擊的簡單方法。您應該使用參數。