2015-09-27 56 views
0

这是我的2个参数的查询。有人可以帮帮我吗?两个表之间的查询

sql = "select * 
     from studentlist 
     where firstname like '%" 
    & Transaction.SEARCHSTUDENT.Text 
    & "%' or studentnum like '%" 
    & Transaction.SEARCHSTUDENT.Text 
    & "%' and not in (select studentnum from borrowing of books where status ='borrowed')" 
+0

请详细说明。你面临的问题或错误是什么?你需要什么帮助? – navigator

+0

Querry错误。我希望从学生名单(表格)中获得不是借书的表格。 –

+1

通过连接字符串来创建查询只是乞求像这样的错误和SQL注入攻击。而不是连接,使用例如@name参数('WHERE FirstName LIKE @name ...')的参数化查询并传递该模式作为参数值。 –

回答

0

如果borrowing of books是你的表名(含空格),它应该与反引号,像这样被封闭:

`borrowing of books` 

编辑:此外,它看起来像studentnum您的where子句中丢失,所以它应该看起来像这样:

sql = "select * 
    from studentlist 
    where (firstname like '%" 
& Transaction.SEARCHSTUDENT.Text 
& "%' or studentnum like '%" 
& Transaction.SEARCHSTUDENT.Text 
& "%') and studentnum not in (select studentnum from `borrowing of books` where status ='borrowed')"