将参数添加到SQL Server SELECT查询

Question

尽我所能，我无法正确地向我的SQL Server SELECT查询添加参数。如果我将查询更改为单个字符串（不带参数），则该代码有效，因此我知道它必须是SqlCommand参数。任何人都可以发现我要去哪里吗？

protected void getSQLData() 
{ 
    string connString = WebConfigurationManager.ConnectionStrings["RegionalHistoryCenterConnectionString"].ConnectionString; /*This can be found in the Web.config file*/ 

    SqlConnection myConnection = new SqlConnection(connString); 
    int recordCount; 

    SqlCommand myCommand = generateSQLQuery(myConnection); 

    /*The using statement ensures that Dispose is called even if an exception occurs while you are calling methods on the object.*/ 
    using (myConnection) 
    { 
     try 
     { 
      // Checking to see if connection is open. It should not be, USING should close the connection automatically 
      if (myConnection.State != ConnectionState.Open) 
      { 
       myConnection.Open(); 
      } 

      //lblmsg.Text = string.Empty; // clear any prevous message to prevent confusion. 

      using (SqlDataAdapter sda = new SqlDataAdapter()) 
      { 
       sda.SelectCommand = myCommand; 
       dset = new DataSet(); 
       sda.Fill(dset); 
       GridViewRecords.DataSource = dset; 
       GridViewRecords.DataBind(); 
      } 
     }//END try 
     catch (Exception ex)  //Good for security purposes, keeps server details from being listed 
     { 
      LabelMsg.Text = ex.Message; 
     } 
    }//END using 
}//end getSQLData() 

/// <summary> 
/// </summary> 
/// <param name="theConnection"></param> 
/// <returns></returns> 
private SqlCommand generateSQLQuery(SqlConnection theConnection) 
{ 
    string mySelectQuery = "SELECT * FROM ManuscriptsCollection "; 

    bool hasKeyword = !string.IsNullOrEmpty(TextBoxKeywords.Text); 

    // If the keyword box is empty and the user was doing a keyword search, throw an error 
    if (hasKeyword == false && queryType.Equals("search")) 
    { 
     LabelMsg.Text = "No search word was entered"; 
    } 

    // If a keyword search is being performed 
    if (hasKeyword && queryType.Equals("search")) 
    { 
     /*.HtmlEncode keeps input from being interpreted as HTML code. This is for security's sake*/ 
     keyword = Server.HtmlEncode(TextBoxKeywords.Text);     
     mySelectQuery += generateKeywordSelects(keyword); 
    } 

    // Order by immigrant's last name 
    mySelectQuery += " ORDER BY Item ASC "; 

    // Unless there is a browse of the entire index, add parameters to help prevent SQL Injection 
    SqlCommand SelectCommand = new SqlCommand(mySelectQuery, theConnection); 
    SelectCommand.Parameters.Add((new SqlParameter("@item", keyword))); 
    SelectCommand.Parameters.Add((new SqlParameter("@snum", keyword))); 
    SelectCommand.Parameters.Add((new SqlParameter("@fnum", keyword))); 
    SelectCommand.Parameters.Add((new SqlParameter("@date", keyword))); 
    SelectCommand.Parameters.Add((new SqlParameter("@notes", keyword))); 

    // Testing 
    //LabelMsg.Text = SelectCommand.Parameters["@item"].Value.ToString(); 
    LabelMsg.Text = SelectCommand.CommandText; 
    return SelectCommand; 
}//END generateSQLQuery 

/*Simply creates a string containing a keyword-select statement*/ 
private string generateKeywordSelects(string theKeyword) 
{ 
    string keywordString = "WHERE "; 
    //Item name 
    keywordString += "Item LIKE '%@item%'"; 
    keywordString += " OR "; 
    //Shelf and Box Number 
    keywordString += "ShelfAndBoxNumber LIKE '%@sbnum%'"; 
    keywordString += " OR "; 
    //File number 
    keywordString += "FileNumber LIKE '%@fnum%'"; 
    keywordString += " OR "; 
    //Date 
    keywordString += "Date LIKE '%@date%'"; 
    keywordString += " OR "; 
    //MISC Notes 
    keywordString += "Notes LIKE '%@notes%'"; 
    return keywordString; 
} 

Answer 1

参数不能包含在一个字符串作为目前工作：

keywordString += "Notes LIKE '%@notes%'"; 
... 
SelectCommand.Parameters.Add((new SqlParameter("@item", keyword))); 

相反，你必须包括SQL通配符的参数值，并使用：

keywordString += "Notes LIKE @notes"; 
... 
SelectCommand.Parameters.Add((new SqlParameter("@item", '%' + keyword + '%'))); 

Answer 2

您正在搜索不使用参数的实际字符串“@date”，参数不能位于字符串内部。拆分%和参数。

private string generateKeywordSelects(string theKeyword) 
{ 
    string keywordString = "WHERE "; 
    //Item name 
    keywordString += "Item LIKE ('%' + @item + '%')"; 
    keywordString += " OR "; 
    //Shelf and Box Number 
    keywordString += "ShelfAndBoxNumber LIKE ('%' + @sbnum + '%')"; 
    keywordString += " OR "; 
    //File number 
    keywordString += "FileNumber LIKE ('%' + @fnum + '%')"; 
    keywordString += " OR "; 
    //Date 
    keywordString += "Date LIKE ('%' + @date + '%')"; 
    keywordString += " OR "; 
    //MISC Notes 
    keywordString += "Notes LIKE ('%' + @notes + '%')"; 
    return keywordString; 
}