如何使用C實現某一年和數量的搜索＃

Question

這是一個SQL數據庫的小演示，可以從SQL服務器中添加，更新刪除成員。

在單個SQL Server數據庫中有兩個表，其中一個是「members」，第二個是「overview」。

• 在成員有喜歡的名稱，地址，電話等
• 在概述中只有三個被做了，今年&金額欄不同的ID列和成員的個人信息。

有一個單獨的窗口形式，語言是C＃和項目建在Visual Studio 2010和SQL Server中，當然數據的基礎上2010年

Windows窗體有一個「復位，插入，更新&刪除「按鈕。

• 有除了其中可插入不同的ID的DID文本框中多了一個按鈕，並點擊搜索按鈕後，有關成員提出的最後一項顯示填寫其中名稱地址電話出現在所有文本框。這提供了會員全部信息可以被看到並且可以進行改變或可以從dB中刪除的功能。
• 特別有兩個文本框，即年份&金額，表示會員在某一年度已支付一定金額。

但正如我在文本框中提到的，您只能看到最後一次輸入。我想達到的功能是插入人x的dID後，我只能在插入的年份文本框中插入任意前一年，並且通常應該使用的新聞搜索用信息填充所有文本框，並且數量文本框應該向我顯示來自dB的條目，根據我輸入的年份數量或者沒有任何這意味着可能會員沒有支付某一年。

我需要幫助以編程方式實現此邏輯，因此我想請求幫助。

本程序如下：

using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Data; 
using System.Data.SqlClient; 
using System.Drawing; 
using System.Linq; 
using System.Text; 
using System.Windows.Forms; 

namespace SQLDatabase 
{ 
    public partial class SQLDBDisplay : Form 
    { 
    SqlConnection con = new SqlConnection("Data Source=JG-PC\\SQLEXPRESS;Initial Catalog=TEST;Integrated Security=True"); 

    public SQLDBDisplay() 
    { 
     InitializeComponent(); 
    } 
    SqlDataAdapter da; 
    DataSet ds = new DataSet(); 


    private void btnSearch_Click(object sender, EventArgs e) 
    { 
     SqlDataReader reader; 
     SqlCommand cmd = new SqlCommand(); 
     try 
     { 
      string sql = "SELECT * FROM members where dID = '" + txtdID.Text + "' "; 
      txtYear.Text = sql; 
      cmd.Connection = con; 
      cmd.CommandText = sql; 
      con.Open(); 
      reader = cmd.ExecuteReader(); 
      while (reader.Read()) 
      { 
       txtID.Text = reader["ID"].ToString(); 
       txtName.Text = reader["Name"].ToString(); 
       txtAddress.Text = reader["Address"].ToString(); 
       txtMobile.Text = reader["Mobile"].ToString(); 
       txtEmail.Text = reader["Email"].ToString(); 
       txtdID.Text = reader["dID"].ToString(); 

      } 
      con.Close(); 

      sql = "SELECT * FROM Overview where dID = '" + txtdID.Text + "' "; 
      txtYear.Text = txtYear.Text + " : " + sql; 
      cmd.Connection = con; 
      cmd.CommandText = sql; 
      con.Open(); 
      reader = cmd.ExecuteReader(); 
      while (reader.Read()) 
      { 
       txtYear.Text = reader["Year"].ToString(); 
       txtAmount.Text = reader["Amount"].ToString(); 
       txtdID.Text = reader["dID"].ToString(); 

      } 
      con.Close(); 
     } 
     catch (Exception ex) 
     { 
      MessageBox.Show(ex.Message.ToString()); 
     } 
    } 

    private void btnReset_Click(object sender, EventArgs e) 
    { 
     txtdID.Text = ""; txtName.Text = ""; txtAddress.Text = ""; 
     txtMobile.Text = ""; txtEmail.Text = ""; txtYear.Text = ""; 
     txtAmount.Text = ""; 
    } 

    private void btnInsert_Click(object sender, EventArgs e) 
    { 
     SqlCommand cmd = new SqlCommand(); 
     string Sql = "INSERT INTO members (dID, Name, Address, Email, Mobile) VALUES ('" + txtdID.Text+ "','" + txtName.Text + "','" 
+ txtAddress.Text + "', '" + txtEmail.Text + "', '" + txtMobile.Text + "')"; 
     cmd.CommandText = Sql; 
     cmd.Connection = con; 
     con.Open(); 
     cmd.ExecuteNonQuery(); 
     con.Close(); 
     Sql = "INSERT INTO Overview (dID, Year, Amount) VALUES ('"+ txtdID.Text +"' ,'" + txtYear.Text + "','" + txtAmount.Text + 
"')"; 
     cmd.CommandText = Sql; 
     cmd.Connection = con; 
     con.Open(); 
     cmd.ExecuteNonQuery(); 
     con.Close(); 
     MessageBox.Show("Record Inserted Scuessfully!!!"); 
     for (int i = 0; i < this.Controls.Count; i++) 
     { 
      if (this.Controls[i] is TextBox) 
      { 
       this.Controls[i].Text = ""; 
      } 
     } 
    } 

    private void btnUpdate_Click(object sender, EventArgs e) 
    { 
      try 
     { 
      SqlCommand cmd = new SqlCommand(); 
      string Sql = "Update members set Name = '" + txtName.Text + "', Address = '" + txtAddress.Text + "', Email = '" + 
txtEmail.Text + "', Mobile = '" + txtMobile.Text + "' WHERE dID = '" 
+ txtdID.Text + "'"; 
      cmd.CommandText = Sql; 
      cmd.Connection = con; 
      con.Open(); 
      cmd.ExecuteNonQuery(); 
      con.Close(); 

      Sql = "Update overview set Year = '" + txtYear.Text + "', Amount = '" + txtAmount.Text + "' WHERE dID = '"+ txtdID.Text+"'"; 
      cmd.CommandText = Sql; 
      cmd.Connection = con; 
      con.Open(); 
      cmd.ExecuteNonQuery(); 
      MessageBox.Show("Data Scuessfully Updated"); 
      con.Close(); 
     } 
     catch (Exception error) 
     { 
      MessageBox.Show(error.ToString()); 
     } 

      for (int i = 0; i < this.Controls.Count; i++) 
      { 
       if (this.Controls[i] is TextBox) 
       { 
        this.Controls[i].Text = ""; 
       } 
      } 
    } 

    private void btnDelete_Click(object sender, EventArgs e) 
    { 
     SqlCommand cmd = con.CreateCommand(); 
     cmd.CommandType = CommandType.Text; 
     cmd.CommandText = "DELETE FROM members WHERE dID = '"+ txtdID.Text +"'"; 
     con.Open(); 
     cmd.ExecuteNonQuery(); 

     cmd.CommandText = "DELETE FROM overview WHERE dID = '" + txtdID.Text + "'"; 
     cmd.ExecuteNonQuery(); 
     da = new SqlDataAdapter(cmd); 

     MessageBox.Show("Record Scuessfully Deleted !"); 
     con.Close(); 

     for (int i = 0; i < this.Controls.Count; i++) 
     { 
      if (this.Controls[i] is TextBox) 
      { 
       this.Controls[i].Text = ""; 
      } 
     } 
    } 


    private void btnClose_Click(object sender, EventArgs e) 
    { 
     Application.Exit(); 
    } 

} } 

Answer 1

要添加一個解決方案，人們對參數和sql注入做出的評論，我傾向於在連接到任何數據庫時使用下面的代碼。

using(SqlConnection connection = new SqlConnection("YOUR CONNECTION STRING")) 
{ 
    try 
    { 
     using(SqlCommand command = new SqlCommand()) 
     { 
      command.CommandText = "SELECT * FROM members where dID = @MyId"; 
      command.Connection = connection; 

      // Set the SqlDbType to your corresponding type 
      command.Parameters.Add("@MyId", SqlDbType.VarChar).Value = txtdID.Text; 

      connection.Open(); 

      SqlDataReader reader = command.ExecuteReader(); 

      while (reader.Read()) 
      { 
       txtID.Text = reader["ID"].ToString(); 
       txtName.Text = reader["Name"].ToString(); 
       txtAddress.Text = reader["Address"].ToString(); 
       txtMobile.Text = reader["Mobile"].ToString(); 
       txtEmail.Text = reader["Email"].ToString(); 
       txtdID.Text = reader["dID"].ToString(); 

      } 
     } 
    } 
    finally 
    { 
     connection.Close(); 
    } 
} 

Answer 2

你需要將你的SELECT上Amount列。一個簡單的回答你的問題是要改變你的第二個選擇查詢是這樣的：

sql = "SELECT Year, dID, SUM(Amount) as Amount FROM Overview where dID = '" + txtdID.Text + "' AND Year = " + txtYear.Text + "GROUP BY amount"; 

也許，你想用的txtYear.Text值的SQL參數，所以：

txtYear.Text = sql; 

和

txtYear.Text = txtYear.Text + " : " + sql; 

在代碼中沒有太多意義。

當然，這不是正確的方法，因爲它很容易出現SQL Injection。我建議你使用SQL Stored Procedures，這對SQL注入來說絕對是比較安全的。

的另一個改進的代碼質量將是你應該使用using語句來包圍SQLConnection，SQLCommand和SQLDataReader對象初始化。