2
我有一個這樣的查詢:你可以在OdbcCommand中使用命名參數嗎?
string command = @"SELECT COUNT(*) as cnt,
(
SELECT COUNT(*) FROM attend
WHERE (DATEPART(WEEKDAY,start_date) = 2 OR DATEPART(WEEKDAY,start_date) = 6)
AND empl_no = ? and pay_code = '051'
AND start_date BETWEEN ? AND ?
) as frimon
FROM attend as a
WHERE empl_no = ? and pay_code = '051'";
我可以計算出指定一個參數是具有?
(而不是使用@name
方法與一個SqlCommand)的唯一方法。這迫使我多次指定相同的參數(如empl_no
)。有沒有辦法使用命名參數與OdbcCommands,所以我可以只指定一個命名參數一次?
在滾動自己的代碼時要小心,以替換不引入潛在SQL注入攻擊的命名參數http://en.wikipedia.org/wiki/Sql_injection – 2011-03-04 06:09:15