加入两个表

Question

st = "SELECT YearLevel FROM Students WHERE StudentID = " & txtStudentID.Text 
    da = New OleDbDataAdapter(st, conn) 
    da.Fill(ds, "Students") 
    YearLevel = ds.Tables("Students").Rows(0).Item("YearLevel") 

    st1 = "SELECT TuitionFee, BookFee, MiscellaneousFee, OtherFee FROM Expenses WHERE YearLevel = " & YearLevel 

    da1 = New OleDbDataAdapter(st1, conn) 
    da1.Fill(ds1, "Expenses") 

所以我有那个代码，然后我有我的第二个查询中缺少运算符的错误，可能的解决方案是什么？

Answer 1

您会收到此错误消息，因为YearLevel的值为Grade 1，因此需要用引号将其转义。所以，你希望你的RDBMS来执行实际的查询可能看起来是这样的：

SELECT TuitionFee, BookFee, MiscellaneousFee, OtherFee 
FROM Expenses 
WHERE YearLevel = 'Grade 1' 

您可以直接在字符串st1中添加引号，但是这可能让门打开SQL注入。这里是一个更加安全的方式去这样做：

MyCommand = New SqlCommand("SELECT TuitionFee, BookFee, MiscellaneousFee, OtherFee FROM Expenses WHERE YearLevel = @YearLevel", conn) 
MyCommand.Parameters.AddWithValue("@YearLevel", YearLevel) 

VB.net应该感觉到参数是字符类型，并自动报价为你逃避它。