从一个文本框将数据添加到一个SQL查询

Question

目前我使用此代码从数据库中的数据读入一个图表：

Dim Conn As OleDbConnection = New OleDbConnection 
Dim provider = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source =" 
Dim dataFile = "\\sch5409.poole.sch.uk\public\HomeDirs\Students\11\11browningale\My Documents\CornmarketCPDDatabase.accdb" 
'UserGDCNumber = GDCNumber.Text 
Conn.ConnectionString = provider & dataFile 
Conn.Open() 
Dim cmd As OleDbCommand = New OleDbCommand("SELECT [Type Of CPD], [Amount of Hours], [GDC Number] FROM [CPD Table], [Amount of CPD Hours]", Conn) 
Dim dr As OleDbDataReader = cmd.ExecuteReader 
While dr.Read 
    Chart1.Series("Amount of Hours").Points.AddXY(dr("Type Of CPD").ToString, dr("Amount of Hours").ToString) 
End While 
dr.Close() 
cmd.Dispose() 

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text", Conn) 
dr = cmd.ExecuteReader 

问题是这一行：

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text", Conn) 

它工作正常没有AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text

我想我的程序要做的是从文本框中读取数据GDCNumber.Text（我知道我应该先将它分配给一个变量），然后使用t我的查询中的帽子数据。

这是错误消息：

类型“System.Data.OleDb.OleDbException”的未处理的异常出现在system.data.dll

其它信息：没有用于一个或给定值。更需要的参数”

Answer 1

你的SQL查询指的是一个叫GDCNumber.Text的事情，但因为这是对事物的VB.Net它到底意味着什么到SQL服务器，而不是你想要的东西，如：。

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = " & GDCNumber.Text, Conn) 

这假定GDCNumber只是一个数字。如果它不是那么你想要：

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = '" & GDCNumber.Text & "'", Conn) 

这是简单的解决方案。然而，像这样构建SQL确实会让你感到一种被称为SQL注入攻击的东西 - 即某人可能在该文本框中编写正确的SQL代码并导致代码中的各种破坏。要解决此问题，您应该了解参数化查询。