sql查询问题答案

【问题标题】：sql query problemsql查询问题
【发布时间】：2011-04-16 04:04:19
【问题描述】：

protected void Button1_Click(object sender, EventArgs e) 
{
    SqlConnection myConnection = new SqlConnection("Data Source=DELL-PC\\SQLEXPRESS;Initial Catalog=eclass;Persist Security Info=True;integrated security = true");
    myConnection.Open();
    string key = txtsearchkey.Text.ToString();

    SqlCommand q1 = new SqlCommand("select cat_id from category where cat_name='" + (ddsearchcat.SelectedItem.ToString() + "'"), myConnection);
    string cat = q1.ExecuteScalar().ToString();

    SqlCommand q2 = new SqlCommand("select subcat_id from subcategory where subcat_name= '" + (ddsearchsubcat.SelectedItem.ToString() + "'"), myConnection);
    string subcat = q2.ExecuteScalar().ToString();

    SqlCommand q3 = new SqlCommand("select adid from adType where adtype= '" + (ddsearchtype.SelectedItem.ToString()) + "'", myConnection);
    string adtype = q3.ExecuteScalar().ToString();

    String date = ddsearchdays.SelectedItem.ToString();

    if (chkAdimg.Checked)
    {
        if (chkAdVideo.Checked)
        {
            SqlCommand query = new SqlCommand("select title,ad_description from postad where ad_description like " + txtsearchkey + " and category_id=" + cat + " and subcategory_id=" + subcat + " and ad_id=" + adtype + " and video is not null and img_id is not null and adType INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid CROSS JOIN  category CROSS JOIN  subcategory CROSS JOIN userdetails", myConnection);           

            DataSet ds = new DataSet();
            SqlDataAdapter ad = new SqlDataAdapter(query);
            ad.Fill(ds);
            foreach (DataRow dr in ds.Tables[0].Rows)
            {
                    Response.Write(dr[0].ToString());
            }
        }
    }
}

这个查询给了我一个问题

非布尔类型的表达式在上下文中指定条件是预期的，靠近'INNER...

我应该对查询进行哪些更改

【问题讨论】：

看起来你的SqlCommand query 行可能是罪魁祸首。我的猜测是您上面的查询之一，您使用值来构建您的 SqlCommand query 正在返回一个无效的值。您应该逐步检查以确保获得正确的值，并且可能应该在使用它们构建另一个查询之前验证这些变量
首先：不将你的 SQL 查询串起来！你知道SQL injection 吗？不要那样做——永远不要。请改用参数化查询！

标签： c# sql-server-2005

【解决方案1】：

我想它就在这里

...and adType INNER JOIN adType...

你的连接应该在 WHERE 子句之前完成，更不用说你真的应该使用参数而不是纯文本来避免像 sql 注入这样的事情，而且你可能需要在你想要的值中使用 %'s点个赞，但我离题了...

【讨论】：

【解决方案2】：

select title,ad_description from postad where ad_description like " + txtsearchkey + " and category_id=" + cat + " and subcategory_id=" + subcat + " and ad_id=" + adtype + " and video is not null and img_id is not null and adType INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid CROSS JOIN  category CROSS JOIN  subcategory CROSS JOIN userdetails", myConnection);

在 where 条件之后你在哪里使用内连接？

我认为这可能是正确的

select title,ad_description 
from postad 
INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid 
CROSS JOIN category 
CROSS JOIN subcategory 
CROSS JOIN userdetails 
where ad_description like " + txtsearchkey + " 
  and category_id=" + cat + " 
  and subcategory_id=" + subcat + " 
  and ad_id=" + adtype + " 
  and video is not null 
  and img_id is not null

【讨论】：

adType INNER JOIN adType AS adType.adid=atType_1.adid
试图在 where 子句中使用内连接？尝试在where子句之前使用它
再一次：这应该使用参数化查询 - 为什么所有这些CROSS JOINs ？这会像疯了一样炸毁响应行的数量！

【解决方案3】：

varchar 列应该用引号将值括起来。例如

where ad_description like " + txtsearchkey + " and

应该是

where ad_description like '" + txtsearchkey + "' and

另外

img_id is not null and adType INNER JOIN

应该有

img_id is not null INNER JOIN

即adType 似乎放错了位置。

这不是制作动态 SQL 的好方法。它不仅暴露于 SQL 注入，而且几乎无法维护。

【讨论】：

【解决方案4】：

您在 WHERE 子句之后有您的联接，它必须在 WHERE 子句之前和 FROM 之后

select 
    title,
    ad_description 
from postad 
INNER JOIN adType AS adType_1 ON adType.adid = adType_1.adid 
CROSS JOIN  category 
CROSS JOIN  subcategory 
CROSS JOIN userdetails
where ad_description like " + txtsearchkey + " 
and category_id=" + cat + " 
and subcategory_id=" + subcat + " 
and ad_id=" + adtype + " 
and video is not null 
and img_id is not null 
and adType "

【讨论】：