C#中SQL的转义字符

Question

我想在我的C#代码中添加一个简单的select语句.示例如下所示.fname中y之类的值来自参数.//从myTable中选择lname,其中fname ='y'

这就是我在做什么.我显然得到了Sql Exception.我该如何纠正？谢谢.

string strOrdersOrigSQL = "SELECT LastName FROM Employees";
// Concatenate the default SQL statement with the "Where" clause and add an OrderBy clause
       strOrdersSQL = strOrdersOrigSQL + "where FirstName ="+ 'strFname';

Answer 1

你永远不应该手工连接sql命令.使用类SqlCommand并添加参数

using (var cmd = new SqlCommand("SELECT LastName FROM Employees where FirstName = @firstName", conn))
{
   cmd.Parameters.AddWithValue("@firstName", strFname);
   var reader = cmd.ExecuteReader();
}