0

我正在尝试删除 users_stocks 表中的一行。

我使用这段代码：

public bool removeStock(string user_name,string stock_symbol)
{
    user_name = user_name.Trim();
    stock_symbol = stock_symbol.Trim();
    string statement = "DELETE FROM " + "users_stocks" + " WHERE user_name = '" + user_name + "'" + " AND " + "stock_symbol = " + "'" + stock_symbol + "'" ;
    SqlCommand cmdnon = new SqlCommand(statement, connection);
    try
    {
        connection.Open();
        int num = cmdnon.ExecuteNonQuery();
         connection.Close();
        return true;
    }
    catch (SqlException ex)
    {
        Console.WriteLine(ex.ToString());
        connection.Close();
        return false;
    }
}

此数据有一行，但查询不会删除它。

我错过了什么？

4

3 回答 3

4

使用参数化查询避免Sql Injection Attacks和引用问题更不用说SqlServer的优化引擎可以存储参数化查询并更快地重用。每次发送到数据库时，都会重新评估手工查询 -

public bool removeStock(string user_name,string stock_symbol) 
{ 
    user_name = user_name.Trim(); 
    stock_symbol = stock_symbol.Trim(); 
    string statement = "DELETE FROM users_stocks " + 
                        "WHERE user_name = @name AND stock_symbol = @stock" ; 
    SqlCommand cmdnon = new SqlCommand(statement, connection); 
    try 
    { 
        cmdnon.Parameters.AddWithValue("@name", user_name);
        cmdnon.Parameters.AddWithValue("@stock", stock_symbol);
        connection.Open(); 
        int num = cmdnon.ExecuteNonQuery(); 
        connection.Close(); 
        return true; 
    } 
    catch (SqlException ex) 
    { 
        Console.WriteLine(ex.ToString()); 
        connection.Close(); 
        return false; 
    } 
}
于 2012-08-11T10:03:11.050 回答
3

正如 Luis Quijada 上面提到的使用参数，它们更安全。在下面的代码中，只需将 YOUR_CONNECTION_STRING 值和 SqlDbType 更改为与您的数据库中匹配的值。

    public bool removeStock(string user_name, string stock_symbol)
    {
        using(SqlConnection connection = new SqlConnection("YOUR_CONNECTION_STRING"))
        {
            using(SqlCommand command = new SqlCommand())
            {
                try
                {
                    command.Connection = connection;
                    command.CommandText = "DELETE FROM user_stocks WHERE user_name=@USERNAME AND stock_symbol=@STOCKSYMBOL";
                    command.Parameters.Add("@USERNAME", SqlDbType.VarChar).Value = user_name.Trim();
                    command.Parameters.Add("@STOCKSYMBOL", SqlDbType.VarChar).Value = stock_symbol.Trim();
                    connection.Open();

                    int i = command.ExecuteNonQuery();

                    if (i == 0)
                        return false;

                    return true;
                }
                catch (Exception ex)
                {
                    Console.WriteLine(ex.ToString());
                    connection.Close();
                    return false;
                }
                finally
                {
                    connection.Close();
                }
            }
        }
    }
于 2012-08-11T10:04:53.060 回答
1

试试这个代码： 

  public bool removeStock(string user_name,string stock_symbol)
  {
      user_name = user_name.Trim();
      stock_symbol = stock_symbol.Trim();
      string statement = "DELETE FROM users_stocks 
                          WHERE user_name = '" + user_name + "' 
                          AND stock_symbol = '" + stock_symbol + "'" ;
      SqlCommand cmdnon = new SqlCommand(statement, connection);
      try
      {
          connection.Open();
          int num = cmdnon.ExecuteNonQuery();
          connection.Close();
          return true;
      }
      catch (SqlException ex)
      {
          Console.WriteLine(ex.ToString());
          connection.Close();
          return false;
      }
  }

查询的变化

于 2012-08-11T10:10:27.037 回答