2012-12-17 74 views
0

新問題。 我有這個作爲我的gridview,我想要它,所以當頁面加載網格視圖充滿了數據庫信息。ASP.NET GridView更新/整體查詢結構

所以下面是gridview的代碼。以下是c#代碼。

UPDATE

<asp:GridView ID="RegistrantsView" runat="server" AllowPaging="True" 
       AllowSorting="True" AutoGenerateColumns="True" 
       CellPadding="4" 
       ForeColor="#333333" GridLines="None"> 
       <AlternatingRowStyle BackColor="White" ForeColor="#284775" /> 
       <EditRowStyle BackColor="#999999" /> 
       <FooterStyle BackColor="#5D7B9D" Font-Bold="True" ForeColor="White" /> 
       <HeaderStyle BackColor="#5D7B9D" Font-Bold="True" ForeColor="White" /> 
       <PagerStyle BackColor="#284775" ForeColor="White" HorizontalAlign="Center" /> 
       <RowStyle BackColor="#F7F6F3" ForeColor="#333333" /> 
       <SelectedRowStyle BackColor="#E2DED6" Font-Bold="True" ForeColor="#333333" /> 
       <SortedAscendingCellStyle BackColor="#E9E7E2" /> 
       <SortedAscendingHeaderStyle BackColor="#506C8C" /> 
       <SortedDescendingCellStyle BackColor="#FFFDF8" /> 
       <SortedDescendingHeaderStyle BackColor="#6F8DAE" /> 
      </asp:GridView> 

C#:

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["FFL-New DataConnectionString"].ConnectionString); 

protected void Page_Load(object sender, EventArgs e) 
{ 
    connection.Open();//opens connection on page load 
    SqlCommand selectAllCommand = new SqlCommand(); 
    selectAllCommand.CommandText = "select * from registrants"; 
    selectAllCommand.Connection = connection; 

    SqlDataAdapter sda = new SqlDataAdapter(); 
    sda.SelectCommand = selectAllCommand; 

    DataTable dt = new DataTable(); 
    sda.Fill(dt); 

    RegistrantsView.DataSource = dt; 
    RegistrantsView.DataBind(); 
} 

回答

0

首先你要注意,你的查詢是容易SQL Injections這是一個安全風險

相反的ExecuteNonQuery的使用DataAdapter和填充一個DataTable,然後設置RegistrantsView 數據源DataBind前:

protected void SearchButton_Click(object sender, EventArgs e) 
{ 
    string searchBoxValue = SearchBox.Text; 
    string columnNameValue = ColumnName.SelectedValue; 
    columnNameValue.ToLower(); 

    string sqlQuery = "select * from registrants"; 
    DataTable dt = new DataTable(); 

    using (SqlCommand searchCommand = new SqlCommand(sqlQuery, connection)) 
    { 
     connection.Open(); 
     using (SqlDataReader reader = cmd.ExecuteReader()) 
     { 
       dt.Load(reader); 
     } 
    } 

    RegistrantsView.DataSource = dt; 
    RegistrantsView.DataBind(); 
} 

如果這是在pageLoad的:

protected void Page_Load(object sender, EventArgs e) 
{ 
    if (!IsPostback) 
    { 
     string sqlQuery = "select * from registrants"; 
     DataTable dt = new DataTable(); 
     using (SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["FFL-New DataConnectionString"].ConnectionString)) 
     { 
      using (SqlCommand searchCommand = new SqlCommand(sqlQuery, connection)) 
      { 
       connection.Open(); 
       using (SqlDataReader reader = cmd.ExecuteReader()) 
       { 
         dt.Load(reader); 
       } 
      } 
     } 
     RegistrantsView.DataSource = dt; 
     RegistrantsView.DataBind(); 
    } 
} 
+0

我會使用參數化查詢,我明白爲什麼現在。但我現在有另一個問題。我仍然使用搜索框來抓取用戶的輸入。我仍然可以接受SQL注入嗎?我應該擺脫搜索框功能嗎? – j0hnstew

+0

@stewbydoo - 不要擺脫搜索框功能,只是不要使用'「select * ... where myColumn =」+ searchTextBox.Text'使用** [參數](http://www.dotnetperls .com/sqlparameter)**而不是 – Blachshma

+0

試過這個,它導致一個錯誤,其中DataSource和DataSource ID都被調用,因此它告訴我使用其中一個或另一個。 – j0hnstew