asp.net - 如何在 Vb 2010 中的 SQL 中使用参数（Web 开发人员）

Question

我正在尝试SQL编写代码，VB但我遇到了问题，我有一个简单的数据库，其中包含表 adminUserName和Password.

我希望能够从文本框中读取数据，然后将其输入到 SQL 字符串中……SQL 字符串有效（我已经测试过），我可以用一个简单的SELECT语句将其输出，但我似乎做不到让 SQL 读取我的参数。

帮助？

Protected Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
    Call Password_Check(txtTestInput.Text)
End Sub

Public Sub Password_Check(ByVal Answer As String)

    Dim con As New SqlConnection
    Dim cmd As New SqlCommand
    Dim parameter As New SqlParameter("@Username", Answer)
    Try

        con.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings("Database1ConnectionString1").ConnectionString
        con.Open()
        cmd.Connection = con
        cmd.CommandText = " SELECT Password FROM Admin WHERE (UserName = @Username)"
        cmd.Parameters.Add(parameter)
        Dim lrd As SqlDataReader = cmd.ExecuteReader()

        While lrd.Read()
            Dim sothing As String

            sothing = lrd("Password").ToString
            If lrd("Password").ToString = txtPassword.Text Then
                lblTestData.Text = "passwordSuccess"
            ElseIf lrd("Password").ToString <> txtPassword.Text Then
                lblTestData.Text = "passwordFail...:("
            End If
        End While

    Catch ex As Exception
        lblTestData.Text = "Error while retrieving records on table..." & ex.Message
    Finally
        con.Close()
    End Try

End Sub

Answer 1

关于您的数据库系统，它可能不支持参数名称。你有没有尝试过 ？您使用的 Wat DB 系统？

cmd.CommandText = " SELECT Password FROM Admin WHERE (UserName = ?)"

Answer 2

在上面的代码中：->Dim parameter As New SqlParameter("@Username", Answer)

我可以建议两个选项：

Dim parameter As New SqlParameter("@Username", sqldbtype.nvarchar)

parameter.value = Answer

或者

cmd.CommandText = string.format("SELECT Password FROM Admin WHERE (UserName = {0})", Answer)

完整代码：

Public Sub Password_Check(ByVal Answer As String)

    Dim con As New SqlConnection
    Dim cmd As New SqlCommand
    Dim parameter As New SqlParameter("@Username", SqlDbType.NVarChar)
    parameter.Value = Answer
    Try

        con.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings("Database1ConnectionString1").ConnectionString
        con.Open()
        cmd.Connection = con
        cmd.CommandText = "SELECT Password FROM Admin WHERE (UserName = @Username)"
        cmd.Parameters.Add(parameter)
        Dim lrd As SqlDataReader = cmd.ExecuteReader()

        While lrd.Read()
            Dim sothing As String

            sothing = lrd("Password").ToString
            If lrd("Password").ToString = txtPassword.Text Then
                lblTestData.Text = "passwordSuccess"
            ElseIf lrd("Password").ToString <> txtPassword.Text Then
                lblTestData.Text = "passwordFail...:("
            End If
        End While

    Catch ex As Exception
        lblTestData.Text = "Error while retrieving records on table..." & ex.Message
    Finally
        con.Close()
    End Try

End Sub