在vb.net中插入字符串變量到sql字符串

Question

我很難將WONum插入到我的sql字符串中。 我曾嘗試在WONum周圍使用'和double''。有人還建議＃和[]，但目前沒有任何工作。

我不斷收到以下錯誤：附近有語法錯誤「1577」

WONum值實際上WO-1577是在運行時間，但執行DA.fill當我得到這個錯誤。我開始認爲破折號在sql中做了一些我不知道的事情。任何幫助都會有所幫助，因爲我必須在我的應用程序中執行更多類似的功能。

Public Function GetTechTimes(ByVal WONum As String) 

    Dim strSQL As String = "Select customer_name, workorder_work_to_be_performed, workorder_work_performed, workorder_notes, workorder_warranty_work, workorder_open_date, workorder_status,workorder_completion_date, wo_tech_name, wo_tech_time, wo_parts_description from Customers, workorders, WorkOrder_Technicians, WorkOrder_Parts Where(customer_id = workorder_customer And wo_tech_wo_id = workorder_id And wo_parts_wo_id = workorder_id And workorder_number = " & WONum & "" 
    Dim DA As New SqlDataAdapter(strSQL, Conn) 
    Dim DS As New DataSet 
    DA.Fill(DS, "TechTimes") 
    Return DS 
End Function 

Answer 1

只要workorder_number是一個字符串，然後把單引號'周圍的WONum是你所需要的。

您不需要＃或方括號。

如果它不適用於單引號，請確保您已正確識別/隔離了您的問題。從sql的末尾刪除And workorder_number = " & WONum & ""，看看它是否可以正常工作。如果不是，那麼你的問題不在WONum中，它早於字符串。

Answer 2

使用Sql-Parameters！這將避免轉換或其他問題，更重要的是可以防止SQL-Injection attacks。

Public Function GetTechTimes(ByVal WONum As String) As DataSet 
    Dim strSQL As String = "SELECT customer_name, " & Environment.NewLine & _ 
    "workorder_work_to_be_performed," & Environment.NewLine & _ 
    "workorder_work_performed, " & Environment.NewLine & _ 
    "workorder_notes, " & Environment.NewLine & _ 
    "workorder_warranty_work, " & Environment.NewLine & _ 
    "workorder_open_date, " & Environment.NewLine & _ 
    "workorder_status, " & Environment.NewLine & _ 
    "workorder_completion_date," & Environment.NewLine & _ 
    "wo_tech_name, " & Environment.NewLine & _ 
    "wo_tech_time, " & Environment.NewLine & _ 
    "wo_parts_description" & Environment.NewLine & _ 
    "FROM(customers," & Environment.NewLine & _ 
    "  workorders," & Environment.NewLine & _ 
    "  workorder_technicians," & Environment.NewLine & _ 
    "  workorder_parts)" & Environment.NewLine & _ 
    "WHERE customer_id = workorder_customer " & Environment.NewLine & _ 
    "AND wo_tech_wo_id = workorder_id " & Environment.NewLine & _ 
    "AND wo_parts_wo_id = workorder_id " & Environment.NewLine & _ 
    "AND workorder_number = @workorder_number " 

    Using con = New SqlConnection(YourConnectionString) 
     Using da = New SqlDataAdapter(strSQL, con) 
      da.SelectCommand.Parameters.AddWithValue("@workorder_number", WONum) 
      Dim DS As New DataSet 
      da.Fill(DS) 
      Return DS 
     End Using 
    End Using 
End Function 

請注意，我還使用Using -statements，以確保所有被即使在例外的情況下，diposed。

再見，你的例外的原因：你有一個開放的支撐在這裏：Where(customer_id從未關閉。