'00'附近语法不正确

Question

我是asp和sql server的新手.我在SQL查询中有问题.

string obal ;
        decimal _obalss = 0;
        decimal obalss = 0;
        sconnection c = new sconnection();
        string cus_id = Session["cusid"].ToString();
        DateTime maxdate = DateTime.Parse(fromdt.Text, new System.Globalization.CultureInfo("en-US"));
        string mdate = maxdate.ToString();
        string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 
        SqlDataReader dr = c.reader(query_sl);
        if (dr.Read())
        {
            decimal.TryParse(dr["amount"].ToString(), out _obalss);
            obalss = _obalss;
        }
        else
        {
            obalss = 0;
        }
            dr.Close();
            dr.Dispose();

Answer 1

 string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 

maxdate是一个约会,你必须把它放在单引号中.更好的是你应该使用参数化的SQL查询,否则你很容易受到SQL注入攻击.这样的事情怎么样:

string query_sl = "select sum(amount) as amount from sale where cusid = @CUSID and invdate < @MAXDATE group by cusid"; 
using(SqlCommand cmd = new SqlCommand(query_sl, c))
{
    cmd.Parameters.Add(new SqlParameter("@CUSID", SqlDbType.Int)).Value = cus_id;
    cmd.Parameters.Add(new SqlParameter("@MAXDATE", SqlDbType.DateTime)).Value = maxdate;
    ...
}