c# - DataAdapter.Fill 语法错误

Question

所以，

尝试编写一个非常简单的方法来更新数据库中的单个列。我在下面的注释行附近不断收到“语法错误”的运行时错误

public void SaveStatus(string id, string step)
    {
        // assuming that there is only one matching student ID
        connect = new SqlConnection(connectionString);
        connect.Open();
        dataSet = new DataSet();
        string command = "SELECT * FROM tblSubmissions WHERE Id = " + id;
        dataAdapter = new SqlDataAdapter(command, connect);

        dataAdapter.Fill(dataSet, "tblSubmissions");  // syntax error near here

        dataSet.Tables[0].Rows[0]["StatusID"] = step;

        dataAdapter.Update(dataSet, "tblSubmissions");
        dataAdapter.Dispose();
        connect.Close();
        connect.Dispose();

    }

希望有人能指出我遗漏的明显问题

Answer 1

查询应该是"SELECT * FROM tblSubmissions WHERE Id = 'id_value'-您缺少id值周围的引号。

使用参数化查询而不是字符串连接来解决您的问题并摆脱 SQL 注入问题：

SqlCommand cmd = new SqlCommand("SELECT * FROM tblSubmissions WHERE Id = @id" , connect);
cmd.Parameters.Add("@id", SqlDbType.UniqueIdentifier);
cmd.Parameters["@id"].Value = id;