0

我的 WebService 有一些问题。当我在数据库中执行查询时，返回正常，但是当我通过服务（在线）执行时，返回错误 System.Data.SqlClient.SqlException: Incorrect syntax near '<'.

代码

    [WebMethod]
    public XmlDocument listagemCredenciadasCoordenadaGeografica(string latitude, string longitude, float raio)
    {
        try
        {
            string s = "SELECT San_Filial.Credenciada_Id " 
                + "FROM San_Filial " 
                + "WHERE (San_Filial.Excluido = 0) " 
                + "AND (San_Filial.Credenciada_Id NOT IN (62, 85, 1, 68, 10, 151, 152, 153, 154, 155)) " 
                + "AND San_Filial.lat != '0' " 
                + "AND San_Filial.lat IS NOT NULL "
                + "AND San_Filial.ddd IS NOT NULL " 
                + "AND ACOS( COS(RADIANS(RTRIM(LTRIM(San_Filial.lat)))) * " 
                + "COS(RADIANS(convert(float," + latitude + "))) * " 
                + "COS(RADIANS(RTRIM(LTRIM(San_Filial.lon))) - " 
                + "RADIANS(convert(float," + longitude + "))) + " 
                + "SIN(RADIANS(RTRIM(LTRIM(San_Filial.lat))) * " 
                + "SIN(RADIANS(convert(float," + latitude + ")))) * 6380 < " + raio + " ";

            XmlDocument xml = new XmlDocument();
            xml.LoadXml(ExecuteStrQuery(s, "Table").GetXml());

            return xml;
        }
        catch (Exception ex)
        {
            throw ex;
        }
    }


public static DataSet ExecuteStrQuery(string Query, string NameTable)
        {
            neticonn.ConexaoWebServices conn = new neticonn.ConexaoWebServices();
            SqlConnection c = new SqlConnection(conn.novaConexao("netservicemobile"));

            DataSet ds = new DataSet();
            SqlDataAdapter da = new SqlDataAdapter();

            try
            {
                SqlCommand cmd = new SqlCommand(Query, c);
                cmd.CommandType = CommandType.Text;
                da = new SqlDataAdapter(cmd);
                da.Fill(ds, NameTable);
                return ds;
            }
            catch (Exception ex)
            {
                throw new Exception(ex.Message, ex);
            }
            finally
            {
                try
                {
                    if (c.State != ConnectionState.Closed)
                    {
                        c.Close();
                        c.Dispose();
                        da.Dispose();
                    }
                }
                catch
                {
                }
            }
        }
4

1 回答 1

3

有两个想法浮现在脑海。

1）无论何时进行sql查询，请使用参数化查询...命名参数更好。串联是坏的，坏的，坏的！如果您不熟悉，请阅读 SQL 注入。

2)&lt;是 html for <，所以我猜你需要先查看 html 编码/解码，然后再使用查询的值

于 2013-02-27T19:14:30.347 回答