将 varchar 数据类型转换为 datetime 数据类型导致 c# 中的值超出范围

Question

我在事件日志中收到以下消息。

The conversion of a varchar data type to a datetime data type resulted in an out-of-range value

请帮助我的网站使用这么多用户，下面是我的按钮点击代码。可能是该字段 TypeOfExpense 出现的错误。

protected void Button1_Click(object sender, EventArgs e)
  {
    if (txt_FromDate.Text != "" && txt_ToDate.Text != "")
    {

        DateTime Fromdate = DateTime.ParseExact(txt_FromDate.Text, "yyyy-MM-dd", CultureInfo.InvariantCulture);
        DateTime Todate = DateTime.ParseExact(txt_ToDate.Text, "yyyy-MM-dd", CultureInfo.InvariantCulture);
        Todate = Todate.Date.AddHours(23).AddMinutes(59).AddSeconds(59);
        ViewState["Fromdate"] = Fromdate;
        ViewState["Todate"] = Todate;

        GridView1.Visible = true;
        SqlConnection cn = new SqlConnection(strConn);
        cn.Open();
        string Query = ("select UserName,ProjectName,ClaimID,Type,DateOfExpense,TypeOfExpense,Amount,Narration,Bill from tbl_DetailedExpenceClaimsInfo  where DateOfExpense between '" + Fromdate + "' and '" + Todate + "' and  ClaimID  in(select ClaimID from tbl_DetailedExpenceClaimsSummaryInfo where status!='Incomplete' ) order by DateOfExpense");

        SqlCommand cmd = new SqlCommand(Query, cn);
        SqlDataAdapter da = new SqlDataAdapter(cmd);
        DataSet ds = new DataSet();
        da.Fill(ds);
        if (ds.Tables[0].Rows.Count > 0)
        {
            GridView1.DataSource = ds;
            GridView1.DataBind();
            // Button1.Visible = true;
            lbl_ErrorMsg.Visible = false;
            Button2.Visible = true;
        }
        else
        {
            Button2.Visible = false;
            GridView1.Visible = false;
            lbl_ErrorMsg.Visible = true;
            lbl_ErrorMsg.Text = "There are no Claim with given Dates !";

        }
        cn.Close();
    }

    else
    {
        lbl_ErrorMsg.Visible = true;
        lbl_ErrorMsg.Text = " Please select the dates!";
    }
}

提前感谢您的支持，非常感谢您

Answer 1

你应该使用参数来避免这种错误以及SQL注入攻击：

const string Query = "select UserName,ProjectName,ClaimID,Type,DateOfExpense,TypeOfExpense,Amount,Narration,Bill from tbl_DetailedExpenceClaimsInfo  where DateOfExpense between @FromDate and @ToDate and ClaimID  in(select ClaimID from tbl_DetailedExpenceClaimsSummaryInfo where status!='Incomplete' ) order by DateOfExpense";

...
SqlCommand cmd = new SqlCommand(Query, cn);
cmd.Parameters.AddWithValue("FromDate", Fromdate);
cmd.Parameters.AddWithValue("ToDate", Todate);
SqlDataAdapter da = new SqlDataAdapter(cmd);
DataSet ds = new DataSet();
...