如何在Sql Server Compact Edition中使用LIKE参数

Question

我正在尝试将使用LIKE关键字的搜索查询与通配符进行参数化.原来的sql有这样的动态sql:

"AND JOB_POSTCODE LIKE '" + isPostCode + "%' "

所以我试过这个,但是我得到了一个FormatException:

"AND JOB_POSTCODE LIKE @postcode + '%' "

编辑:我想FormatException不会来自Sql Server CE,所以根据要求,这是我在C#代码中设置参数的方法.该参数在代码中设置如下:

command.Parameters.Add("@postcode", SqlDbType.NVarChar).Value = isPostCode;

我也尝试过:

"AND JOB_POSTCODE LIKE @postcode"

同

command.Parameters.Add("@postcode", SqlDbType.NVarChar).Value = isPostCode + "%";

但这不会返回任何结果.谁能建议如何在这个搜索sql中使用参数？

Answer 1

简短的回答是你应该将通配符放在参数的值中,而不是在CommandText中.即

不是那个: sqlCommand.CommandText = "SELECT * FROM JOB WHERE JOB_POSTCODE LIKE @postcode%"

这个:

sqlCommand.CommandText = "SELECT * FROM JOB WHERE JOB_POSTCODE LIKE @postcode";
sqlCommand.Parameters.Add("@postcode", SqlDbType.NVarChar).Value = postCode + "%";

这里答案很长:

我回去把我的代码剥离到基本要素,以便我可以在这里发布,并且在这样做时我发现我在原始问题中尝试的最后一种方法确实有效.我的测试肯定有问题.所以这是一个摘要,其中包含已运行的完整代码:

原始的动态sql,容易受到sql注入:

//Dynamic sql works, returns 2 results as expected, 
//but I want to use parameters to protect against sql injection

string postCode = "G20";
sqlCommand.CommandText = "SELECT * FROM JOB WHERE JOB_POSTCODE LIKE '" 
                         + postCode + "%'";
return Database.fGetDataSet(sqlCommand, 
                            iiStartRecord, 
                            iiMaxRecords, 
                            "JOBVISIT");

首次尝试使用参数会出错:

//This syntax with a parameter gives me an error 
//(note that I've added the NVarChar length as suggested:
//System.FormatException : @postcode : G20 - 
//Input string was not in a correct format.
//at System.Data.SqlServerCe.SqlCeCommand.FillParameterDataBindings()
//at System.Data.SqlServerCe.SqlCeCommand.ExecuteCommandText(IntPtr& pCursor,
// Boolean& isBaseTableCursor)

string postCode = "G20";
sqlCommand.CommandText = "SELECT * FROM JOB WHERE JOB_POSTCODE LIKE @postcode 
                         + '%'";
sqlCommand.Parameters.Add("@postcode", 
                          SqlDbType.NVarChar, 
                          10).Value = postCode;
return Database.fGetDataSet(sqlCommand, iiStartRecord, iiMaxRecords, "JOBVISIT");

第二种技术确实有效:

///This syntax with a parameter works, returns 2 results as expected
string postCode = "G20";
sqlCommand.CommandText = "SELECT * FROM JOB WHERE JOB_POSTCODE LIKE @postcode";
sqlCommand.Parameters.Add("@postcode", SqlDbType.NVarChar).Value = postCode 
                                                                   + "%";
return Database.fGetDataSet(sqlCommand, iiStartRecord, iiMaxRecords, "JOBVISIT");

感谢所有的投入,并抱歉原来的误导性问题......