如何使用C#实现对特定年份和金额的搜索

Question

这是一个SQL数据库的小型演示,可以添加,更新SQL服务器中的删除成员.

单个SQL Server DB中有两个表,一个是"成员",第二个是"概述".

• 在会员中有不同的ID栏和会员个人信息,如姓名,地址电话等.
• 总的来说,只有三列是dID,年份和金额.

有一个单一的窗体,语言是c#,项目是在Visual Studio 2010中构建的,当然还有SQL Server 2010中的数据库.

Windows窗体具有"重置,插入,更新和删除"按钮.

• 除了dID文本框之外还有一个按钮,其中可以插入不同的ID,并且在单击"搜索"按钮后,通过填写名称地址电话出现的所有文本框,显示有关成员的最后一个条目.这提供了可以看到成员完整信息并且可以进行更改或可以从dB中移除的功能.
• 特别是有两个文本框,分别是年份和金额,表示该成员已在特定年份支付了一定金额.

但正如我在文本框中提到的,您只能看到最后一个条目.我想要实现的功能是在插入人物x的dID后我只能在年份文本框中插入可以说任何前一年和按下搜索通常要填写所有文本框的信息,并且金额文本框应该显示我从dB输入的条目,根据我输入的年份有多少金额或没有任何意味着可能是会员没有支付某一年.

我需要帮助以编程方式实现此逻辑,因此我想请求帮助.

目前的方案如下:

using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Data; 
using System.Data.SqlClient;
using System.Drawing; 
using System.Linq; 
using System.Text; 
using System.Windows.Forms;

namespace SQLDatabase 
{
     public partial class SQLDBDisplay : Form
     {
     SqlConnection con = new SqlConnection("Data Source=JG-PC\\SQLEXPRESS;Initial Catalog=TEST;Integrated Security=True");

     public SQLDBDisplay()
     {
         InitializeComponent();
     }
     SqlDataAdapter da;
     DataSet ds = new DataSet();


     private void btnSearch_Click(object sender, EventArgs e)
     {
         SqlDataReader reader;
         SqlCommand cmd = new SqlCommand();
         try
         {
             string sql = "SELECT * FROM members where dID =  '" + txtdID.Text + "' ";
             txtYear.Text = sql;
             cmd.Connection = con;
             cmd.CommandText = sql;
             con.Open();
             reader = cmd.ExecuteReader();
             while (reader.Read())
             {
                 txtID.Text = reader["ID"].ToString();
                 txtName.Text = reader["Name"].ToString();
                 txtAddress.Text = reader["Address"].ToString();
                 txtMobile.Text = reader["Mobile"].ToString();
                 txtEmail.Text = reader["Email"].ToString();
                 txtdID.Text = reader["dID"].ToString();

             }
             con.Close();

             sql = "SELECT * FROM Overview where dID =  '" + txtdID.Text + "' ";
             txtYear.Text = txtYear.Text + " : " + sql;
             cmd.Connection = con;
             cmd.CommandText = sql;
             con.Open();
             reader = cmd.ExecuteReader();
             while (reader.Read())
             {
                 txtYear.Text = reader["Year"].ToString();
                 txtAmount.Text = reader["Amount"].ToString();
                 txtdID.Text = reader["dID"].ToString();

             }
             con.Close();
         }
         catch (Exception ex)
         {
             MessageBox.Show(ex.Message.ToString());
         }
     }

     private void btnReset_Click(object sender, EventArgs e)
     {
         txtdID.Text = ""; txtName.Text = ""; txtAddress.Text = "";
         txtMobile.Text = ""; txtEmail.Text = ""; txtYear.Text = "";
         txtAmount.Text = "";
     }

     private void btnInsert_Click(object sender, EventArgs e)
     {
         SqlCommand cmd = new SqlCommand();
         string Sql = "INSERT INTO members (dID, Name, Address, Email, Mobile) VALUES ( '" + txtdID.Text+ "','" + txtName.Text + "','"
+ txtAddress.Text + "', '" + txtEmail.Text + "', '" + txtMobile.Text + "')";
         cmd.CommandText = Sql;
         cmd.Connection = con;
         con.Open();
         cmd.ExecuteNonQuery();
         con.Close();
         Sql = "INSERT INTO Overview (dID, Year, Amount) VALUES ('"+ txtdID.Text +"' ,'" + txtYear.Text + "','" + txtAmount.Text +
"')";
         cmd.CommandText = Sql;
         cmd.Connection = con;
         con.Open();
         cmd.ExecuteNonQuery();
         con.Close();
         MessageBox.Show("Record Inserted Scuessfully!!!");
         for (int i = 0; i < this.Controls.Count; i++)
         {
             if (this.Controls[i] is TextBox)
             {
                 this.Controls[i].Text = "";
             }
         }
     }

     private void btnUpdate_Click(object sender, EventArgs e)
     {
          try
         {
             SqlCommand cmd = new SqlCommand();
             string Sql = "Update members set Name = '" + txtName.Text + "', Address = '" + txtAddress.Text + "', Email = '" +
txtEmail.Text + "', Mobile = '" + txtMobile.Text + "'  WHERE dID = '"
+ txtdID.Text + "'";
             cmd.CommandText = Sql;
             cmd.Connection = con;
             con.Open();
             cmd.ExecuteNonQuery();
             con.Close();

             Sql = "Update overview set Year = '" + txtYear.Text + "', Amount = '" + txtAmount.Text + "' WHERE dID = '"+ txtdID.Text+"'";
             cmd.CommandText = Sql;
             cmd.Connection = con;
             con.Open();
             cmd.ExecuteNonQuery();
             MessageBox.Show("Data Scuessfully Updated");
             con.Close();
         }
         catch (Exception error)
         {
             MessageBox.Show(error.ToString());
         }

          for (int i = 0; i < this.Controls.Count; i++)
          {
              if (this.Controls[i] is TextBox)
              {
                  this.Controls[i].Text = "";
              }
          }
     }

     private void btnDelete_Click(object sender, EventArgs e)
     {
         SqlCommand cmd = con.CreateCommand();
         cmd.CommandType = CommandType.Text;
         cmd.CommandText = "DELETE FROM members WHERE dID = '"+ txtdID.Text +"'";
         con.Open();
         cmd.ExecuteNonQuery();

         cmd.CommandText = "DELETE FROM overview WHERE dID = '" + txtdID.Text + "'";
         cmd.ExecuteNonQuery();
         da = new SqlDataAdapter(cmd);

         MessageBox.Show("Record Scuessfully Deleted !");
         con.Close();

         for (int i = 0; i < this.Controls.Count; i++)
         {
             if (this.Controls[i] is TextBox)
             {
                 this.Controls[i].Text = "";
             }
         }
     }


     private void btnClose_Click(object sender, EventArgs e)
     {
         Application.Exit();
     }

 } }

Answer 1

为了向人们对参数和 SQL 注入所做的评论添加解决方案，我倾向于在连接到任何数据库时使用下面的代码。

using(SqlConnection connection = new SqlConnection("YOUR CONNECTION STRING"))
{
    try
    {
        using(SqlCommand command = new SqlCommand())
        {
            command.CommandText = "SELECT * FROM members where dID = @MyId";
            command.Connection = connection;

            // Set the SqlDbType to your corresponding type
            command.Parameters.Add("@MyId", SqlDbType.VarChar).Value = txtdID.Text;

            connection.Open();

            SqlDataReader reader = command.ExecuteReader();

            while (reader.Read())
            {
                txtID.Text = reader["ID"].ToString();
                txtName.Text = reader["Name"].ToString();
                txtAddress.Text = reader["Address"].ToString();
                txtMobile.Text = reader["Mobile"].ToString();
                txtEmail.Text = reader["Email"].ToString();
                txtdID.Text = reader["dID"].ToString();

            }
        }
    }
    finally
    {
        connection.Close();
    }
 }