'00'附近的語法不正確

Question

我是新的asp & sql服務器。我在sql查詢中遇到問題。

string obal ; 
     decimal _obalss = 0; 
     decimal obalss = 0; 
     sconnection c = new sconnection(); 
     string cus_id = Session["cusid"].ToString(); 
     DateTime maxdate = DateTime.Parse(fromdt.Text, new System.Globalization.CultureInfo("en-US")); 
     string mdate = maxdate.ToString(); 
     string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 
     SqlDataReader dr = c.reader(query_sl); 
     if (dr.Read()) 
     { 
      decimal.TryParse(dr["amount"].ToString(), out _obalss); 
      obalss = _obalss; 
     } 
     else 
     { 
      obalss = 0; 
     } 
      dr.Close(); 
      dr.Dispose(); 

Answer 1

string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 

maxdate是一個日期，你必須把它放在單引號。更好的是你應該使用參數化的SQL查詢，否則你很容易受到SQL注入攻擊。怎麼樣是這樣的：

string query_sl = "select sum(amount) as amount from sale where cusid = @CUSID and invdate < @MAXDATE group by cusid"; 
using(SqlCommand cmd = new SqlCommand(query_sl, c)) 
{ 
    cmd.Parameters.Add(new SqlParameter("@CUSID", SqlDbType.Int)).Value = cus_id; 
    cmd.Parameters.Add(new SqlParameter("@MAXDATE", SqlDbType.DateTime)).Value = maxdate; 
    ... 
} 

Answer 2

string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < '" + maxdate + "' group by cusid"; 

注意周圍的maxDate單引號...