System.Data.dll中出现"System.Data.SqlClient.SqlException"类型的异常

Question

我是c#的初学者,当我执行代码时出现此错误消息>>

"System.Data.dll中出现'System.Data.SqlClient.SqlException'类型的异常,但未在用户代码中处理

附加信息:'='附近的语法不正确."

这是代码!!

string position;

SqlConnection con = new SqlConnection("server=free-pc\\FATMAH; Integrated Security=True; database=Workflow; ");
con.Open();
SqlCommand cmd = new SqlCommand("SELECT EmpName FROM Employee WHERE EmpID=" + id.Text, con);

SqlDataReader Read = cmd.ExecuteReader();

if (Read.Read()==true)
{
    position = Read[0].ToString();
    Response.Write("User Registration successful");
}
else
{
    Console.WriteLine("No Employee found.");
}

Read.Close(); 

Answer 1

您的代码存在一些问题.首先,我建议使用参数化查询,以避免SQL注入攻击,并且框架也会发现参数类型:

var cmd = new SqlCommand("SELECT EmpName FROM Employee WHERE EmpID = @id", con);
cmd.Parameters.AddWithValue("@id", id.Text);

其次,因为您只对从查询返回的一个值感兴趣,所以最好使用ExecuteScalar MSDN:

var name = cmd.ExecuteScalar();

if (name != null)
{
   position = name.ToString();
   Response.Write("User Registration successful");
}
else
{
    Console.WriteLine("No Employee found.");
}

最后一件事是包装SqlConnection和SqlCommand成using使那些使用的任何资源将配置:

string position;

using (SqlConnection con = new SqlConnection("server=free-pc\\FATMAH; Integrated Security=True; database=Workflow; "))
{
  con.Open();

  using (var cmd = new SqlCommand("SELECT EmpName FROM Employee WHERE EmpID = @id", con))
  {
    cmd.Parameters.AddWithValue("@id", id.Text);

    var name = cmd.ExecuteScalar();

    if (name != null)
    {
       position = name.ToString();
       Response.Write("User Registration successful");
    }
    else
    {
        Console.WriteLine("No Employee found.");
    }
  }
}

Answer 2

我认为你的EmpID专栏是字符串,你忘记使用' '你的价值.

因为当你写作时EmpID=" + id.Text,你的命令看起来像EmpID = 12345而不是EmpID = '12345'

改变你SqlCommand的

SqlCommand cmd = new SqlCommand("SELECT EmpName FROM Employee WHERE EmpID='" + id.Text +"'", con);

或者作为一种更好的方式,您可以(并且应该)始终使用parameterized queries.这种字符串连接是开放的SQL Injection攻击.

SqlCommand cmd = new SqlCommand("SELECT EmpName FROM Employee WHERE EmpID = @id", con);
cmd.Parameters.AddWithValue("@id", id.Text);

我认为你的EmpID专栏会保留你的员工ID,所以它的类型应该是一些数字类型而不是字符.