C＃.NET MVC傳遞參數從DB

Question

加載數據，我想傳遞一個值，我從我的角度複選框了。（已經檢查到的數量），從我的數據庫查詢某個數據。 看看我的連接查詢..

private static string m_sConnectionString = ConfigurationManager.ConnectionStrings["NomsConnection"].ConnectionString; 
    private static string 
     m_sReport = "SELECT r.[RequestID],r.[RequestDate],r.[PARNumber],r.[StatusID],r.[PurchaseComment]" // 0 - 4 
        + ",r.[UID],r.[LearUID],r.[FullName],r.[Email]"        // 5 - 8 
        + ",r.[EntityName],r.[DepartmentName],r.[DepartmentID]"    // 9 - 11 
        + ",r.[InboxLearUID]"                // 12 

        + ",r.[ProgramID],r.[ProgramCode],r.[ProgramName],r.[CostCenterCode]"    // 13 - 16 
        + ",p.[PartDesc],p.[SupplierID],p.[AccountType],p.[CurrName],p.[PartQuantity],p.[PiecePrice], p.[PartNumber]" 
        + "FROM [NOP_PR].[dbo].[Requests] r " 
        + "JOIN [NOP_PR].[dbo].[Parts] p on p.[RequestID] = r.[RequestID]" 
        + "JOIN [NOP_PR].[dbo].[Departments] d on d.[DepartmentID] = r.[DepartmentID]" 
        + "WHERE [CountryName] IN ('Philippines') "; 
    //ORDER BY r.[RequestDate] DESC"; 




public static List<NomsPRRequest> LoadPRfromDB_withParams(DateTime from, DateTime to, string EntityID, 
      string DepartmentID, string [] StatusID) 
     { 
      string sScript = m_sReport + ((EntityID == "") ? "" : " AND d.[EntityID]=" + EntityID) + ((DepartmentID == "") ? "" : " AND d.[DepartmentID]=" + DepartmentID) 
       + " and [RequestDate] between '" + from.ToString("yyyy-MM-dd HH:mm:ss") + "' and '" + to.ToString("yyyy-MM-dd HH:mm:ss") + "'" + " and " + (( __________) ? "" : " AND d.[StatusID] in (" + ____________ + ")" ); 


      Dictionary<long, NomsPRRequest> data = new Dictionary<long, NomsPRRequest>(); 
      long key; 
      double dAmount; 
      using (SqlConnection con = new SqlConnection(m_sConnectionString)) 
      { 
       con.Open(); 
       using (SqlCommand command = new SqlCommand(sScript, con)) 
       { 
        SqlDataReader reader = command.ExecuteReader(); 
        while (reader.Read()) 
        { 
         key = reader.GetInt64(0); 
         if (!data.ContainsKey(key)) 
         { 
          data.Add(key, new NomsPRRequest() 
          { 
           RequestID = key, 
           RequestDate = reader.GetDateTime(1), 
           PARNumber = reader.GetString(2), 
           DepartmentName = reader.GetString(10), 
           DepartmentID = reader.GetInt64(11), 
           StatusID = reader.GetInt64(3), 
           FullName = reader.GetString(7), 
           InboxLearUID = reader.GetString(12), 
           ProgramName = reader.GetString(14), 
           ItemList = new List<NomsPRItem>(), 
           TotalAmount = 0.0 
          }); 
         } 
         dAmount = (double)reader.GetDecimal(21) * (double)reader.GetDecimal(22); 
         data[key].TotalAmount += dAmount; 
         data[key].ItemList.Add(new NomsPRItem() 
         { 
          RequestID = key, 
          PartDesc = reader.GetString(17), 
          PartNumber = reader.GetString(23), 
          SupplierID = reader.GetString(18), 
          FullName = reader.GetString(7), 
          AccountType = reader.GetString(19), 
          CurrName = reader.GetString(20), 
          PartQuantity = (double)reader.GetDecimal(21), 
          PiecePrice = (double)reader.GetDecimal(22), 
          Amount = dAmount 
         }); 
        } 
       } 
      } 

      return data.Values.ToList(); 
     } 

，僅此而已。與下劃線的查詢是什麼，我想解決的問題。

string sScript = m_sReport + ((EntityID == "") ? "" : " AND d.[EntityID]=" + EntityID) + ((DepartmentID == "") ? "" : " AND d.[DepartmentID]=" + DepartmentID) 
      + " and [RequestDate] between '" + from.ToString("yyyy-MM-dd HH:mm:ss") + "' and '" + to.ToString("yyyy-MM-dd HH:mm:ss") + "'" + " and " + (( __________) ? "" : " AND d.[StatusID] in (" + ____________ + ")" ); 

還有什麼在我的MVC控制器傳遞。

public JsonResult GetList() 
    { 
     DateTime today = DateTime.Now; 
     List<NomsPRRequest> model = NomsConnection.LoadPRfromDB_withParams(new DateTime(today.Year, today.Month, 1, 0, 0, 0), today,"",""); 

     return Json(model, JsonRequestBehavior.AllowGet); 
    } 

    public JsonResult GetReportList(string from, string to, string EntityID="", string DepartmentID="", int StatusID) 
    { 
     DateTime fromd = DateTime.Now; 
     DateTime tod = DateTime.Now; 
     if (from != "undefined") 
      fromd = Convert.ToDateTime(from); 
     if (to != "undefined") 
      tod = Convert.ToDateTime(to); 
     fromd = new DateTime(fromd.Year, fromd.Month, fromd.Day, 0, 0, 0); 
     tod = new DateTime(tod.Year, tod.Month, tod.Day, 23, 59, 59); 
     return Json(NomsConnection.LoadPRfromDB_withParams(fromd, tod, EntityID, DepartmentID, StatusID), JsonRequestBehavior.AllowGet); 
    } 

這是我的看法

  <ul class="dropdown-menu" role="menu" data-ng-click="$event.stopPropagation()"> 
          <li data-ng-repeat="item in StatusList"> 
           <label class="checkbox-inline"> 
            <input type="checkbox" data-checklist-value="1" data-checklist-model="filter.StatusID" /> 
            {{item}} 
           </label> 
          </li> 
         </ul> 

和我的角度

 scope.array_ = angular.copy(scope.array); 
     scope.getStatus = http.get('GetStatusList').success(function (status) { 
      scope.StatusList = status; 

     }); 


     PRApp.directive("checkboxGroup", function() { 
      return { 
       restrict: "A", 
       link: function (scope, elem, attrs) { 
        // Determine initial checked boxes 
        if (scope.array.indexOf(scope.item.id) !== -1) { 
         elem[0].checked = true; 
        } 

        // Update array on click 
        elem.bind('click', function() { 
         var index = scope.array.indexOf(scope.item.id); 
         // Add if checked 
         if (elem[0].checked) { 
          if (index === -1) scope.array.push(scope.item.id); 
         } 
          // Remove if unchecked 
         else { 
          if (index !== -1) scope.array.splice(index, 1); 
         } 
         // Sort and update DOM display 
         scope.$apply(scope.array.sort(function (a, b) { 
          return a - b 
         })); 
        }); 
       } 
      } 
     }); 

而且傳遞數據時要如何處理這個部分添加....

 scope.changeDate = function() { 
      scope.models = null; 
      var e = document.getElementById("entityList"); 
      scope.EntityID = e.options[e.selectedIndex].value; 
      e = document.getElementById("deptList"); 
      scope.DepartmentID = e.options[e.selectedIndex].value; 
      // console.log(this.filter_fromDate); 
      //console.log(this.filter_toDate); 
      http.get('GetReportList?from=' + scope.filter_fromDate + '&to=' + scope.filter_toDate + '&EntityID=' + scope.EntityID + '&DepartmentID=' + scope.DepartmentID).success(
       function (data) { 
        scope.models = data; 
       }); 
     } 

Answer 1

首先你的SQL查詢應該是parameterised以防止SQL injection attacks。

鑑於您的問題似乎是您需要查詢來閱讀.... AND d.statusid IN ([status1], [status2], [status3] ......)。要做到這一點，你可以使用參數。首先，我們需要爲每個字符串參數起來StatusId

string sScript = m_sReport 
    + ((EntityID == "") ? "" : " AND d.[EntityID]=" 
    + EntityID) + ((DepartmentID == "") ? "" : " AND d.[DepartmentID]=" 
    + DepartmentID) + " and [RequestDate] between '" 
    + from.ToString("yyyy-MM-dd HH:mm:ss") + "' and '" 
    + to.ToString("yyyy-MM-dd HH:mm:ss") + "'" + " and " 
    + (( __________) ? "" : " AND d.[StatusID] in ("; 

int paramCount=0; 
foreach(string Id in StatusId) 
{ 

    sScript = sScript + "@statusParam" + paramCount + ","; 
    paramCount++; 
} 
sScript = sScript + ");"; 

未來

我們需要填補每個參數，所以以後我們初始化連接等：

using (SqlCommand command = new SqlCommand(sScript, con)) 
{ 
    paramCount = 0; 
    foreach(string Id in StatusId) 
    { 
     string paramName = "@statusParam" + paramCount; 
     command.Parameters.AddWithValue(paramName,Id); 
     paramCount++; 
    } 
    SqlDataReader reader = command.ExecuteReader(); 
    /*..........rest of the code */ 
} 

我我沒有在任何IDE中卡住這個，所以可能會有小的語法錯誤，但你明白了。