将字符串变量插入vb.net中的sql字符串

Question

我很难将WONum插入到我的sql字符串中.我试过在WONum周围使用'和double'.有人还建议#和[]围绕它,但到目前为止没有任何工作.

我一直收到以下错误:'1577'附近的语法不正确

在运行期间,WONum值实际上是WO-1577,但是当执行DA.fill时,我得到了该错误.我开始认为破折号在sql中做了一些我不知道的事情.任何帮助都会有所帮助,因为我必须在我的应用程序中执行几个类似的功能.

Public Function GetTechTimes(ByVal WONum As String)

    Dim strSQL As String = "Select customer_name, workorder_work_to_be_performed, workorder_work_performed, workorder_notes, workorder_warranty_work, workorder_open_date, workorder_status,workorder_completion_date, wo_tech_name, wo_tech_time, wo_parts_description from Customers, workorders, WorkOrder_Technicians, WorkOrder_Parts Where(customer_id = workorder_customer And wo_tech_wo_id = workorder_id And wo_parts_wo_id = workorder_id And workorder_number = " & WONum & ""
    Dim DA As New SqlDataAdapter(strSQL, Conn)
    Dim DS As New DataSet
    DA.Fill(DS, "TechTimes")
    Return DS
End Function

Answer 1

用Sql-Parameters!这将避免转换或其他问题 - 更重要的是 - 防止SQL注入攻击.

Public Function GetTechTimes(ByVal WONum As String) As DataSet
    Dim strSQL As String = "SELECT customer_name, " & Environment.NewLine & _
    "workorder_work_to_be_performed," & Environment.NewLine & _
    "workorder_work_performed, " & Environment.NewLine & _
    "workorder_notes, " & Environment.NewLine & _
    "workorder_warranty_work, " & Environment.NewLine & _
    "workorder_open_date, " & Environment.NewLine & _
    "workorder_status, " & Environment.NewLine & _
    "workorder_completion_date," & Environment.NewLine & _
    "wo_tech_name, " & Environment.NewLine & _
    "wo_tech_time, " & Environment.NewLine & _
    "wo_parts_description" & Environment.NewLine & _
    "FROM(customers," & Environment.NewLine & _
    "       workorders," & Environment.NewLine & _
    "       workorder_technicians," & Environment.NewLine & _
    "       workorder_parts)" & Environment.NewLine & _
    "WHERE customer_id = workorder_customer " & Environment.NewLine & _
    "AND wo_tech_wo_id = workorder_id " & Environment.NewLine & _
    "AND wo_parts_wo_id = workorder_id " & Environment.NewLine & _
    "AND workorder_number = @workorder_number "

    Using con = New SqlConnection(YourConnectionString)
        Using da = New SqlDataAdapter(strSQL, con)
            da.SelectCommand.Parameters.AddWithValue("@workorder_number", WONum)
            Dim DS As New DataSet
            da.Fill(DS)
            Return DS
        End Using
    End Using
End Function

请注意,我还使用Using-statements来确保即使在异常的情况下所有都被取消.

再见,你的例外的原因是:你在这里有一个左大括号:Where(customer_id从未关闭.