显示是否按名称或EmpID查找记录

Question

using (SqlConnection myDatabaseConnection = new SqlConnection(myConnectionString.ConnectionString))
{
    myDatabaseConnection.Open();
    using (SqlCommand mySqlCommand = new SqlCommand("Select EmpID, Name from Employee WHERE EmpID = @EmpID OR Name = @Name ", myDatabaseConnection))
    {
        mySqlCommand.Parameters.AddWithValue("@EmpID", textBox1.text);
        mySqlCommand.Parameters.AddWithValue("@Name", textBox1.text);
        DataSet ds = new DataSet();
        SqlDataAdapter adapter = new SqlDataAdapter(mySqlCommand);
        adapter.Fill(ds);
        dataGridView1.DataSource = ds.Tables[0];  
    }
}

样本数据库

EmpID          Name
4001           Johnny Bravo
4002           Bruce Smith
4003           Vince Walker

当我在textBox1上键入4001时,这就是结果

EmpID          Name
4001           Johnny Bravo

当我在textBox1上键入Bruce Smith时,这就是结果

EmpID          Name
4002           Bruce Smith

我需要的是显示是通过EmpID还是名称查找记录.例如,我键入4003文本框或标签等将类似"由EmpID找到记录".当我输入文斯沃克时,它就像"记录是由名字找到的".

Answer 1

首先,您需要修复 SQL注入漏洞.本文应该让您了解参数化查询.

其次,您可以将case语句放入查询中以指示匹配的值.例:

SELECT CASE WHEN EmpID = @EmpId 
           THEN 1 
           ELSE 0
       END AS MatchedEmpId
FROM Whatever