【问题标题】:vb.net multiple search statements in one subroutinevb.net 一个子程序中的多个搜索语句
【发布时间】:2021-12-03 04:53:55
【问题描述】:

我有 5 个选择语句来搜索构建搜索变量的 SQLite 数据库
一个名为 frmBuildSearches 的表单,并通过 DataGridView
传递给一个表单 我要克服的问题是我需要为每个构建的搜索类型设置 5 个子例程
我想将 5 个搜索语句放在一个子例程中,并在调用该子例程时做出决定
将使用哪个搜索语句。这是我第一次使用 “使用” 语句
这是挑战的开始,经过大量的试验和错误已经停止
下面的代码是一个子例程,其中 4 个搜索语句被注释掉
问题 如何使用“使用”语句将搜索语句嵌入到一个子例程中?

    Private Sub MoRangeYr()
    Dim intID As Integer
    Dim strDate As String
    Dim strTxType As String
    Dim strAmt As Decimal
    Dim strCKNum As String
    Dim strDesc As String
    Dim strBal As Decimal
    Dim rowCount As Integer
    Dim maxRowCount As Integer
    Dim emptyStr As String = "  "

    Using conn As New SQLiteConnection($"Data Source = '{gv_dbName}';Version=3;")
        conn.Open()
        '========================
        'Designed Searches Below
        'All
        'Using cmd As SQLiteCommand = New SQLiteCommand($"SELECT * FROM TxData", conn)
        'MoYr
        'Using cmd As SQLiteCommand = New SQLiteCommand($"SELECT * FROM TxData WHERE txSearchMonth = '{gvFromMonth}' AND txYear = '{gvYear}' ", conn)
        'TxMoYr
        'Using cmd As SQLiteCommand = New SQLiteCommand($"SELECT * FROM TxData WHERE txType = '{gvTxType}' AND txSearchMonth = '{gvFromMonth}'AND txYear = '{gvYear}' ", conn)
        'Year
        'Using cmd As SQLiteCommand = New SQLiteCommand($"SELECT * FROM TxData WHERE txYear = '{gvYear}' ", conn)
        '=========================
        'MoRangeYr
        Using cmd As SQLiteCommand = New SQLiteCommand($"SELECT * FROM TxData WHERE  txSearchMonth = '{gvFromMonth}' AND txSearchMonth = '{gvToMonth}' AND txYear = '{gvYear}' ", conn)

            Using rdr As SQLite.SQLiteDataReader = cmd.ExecuteReader

                While rdr.Read()
                    intID = CInt((rdr("TID")))
                    strDate = rdr("txSortDate").ToString
                    strTxType = rdr("txType").ToString
                    strAmt = CDec(rdr("txAmount"))
                    strCKNum = rdr("txCKNum").ToString
                    strDesc = rdr("txDesc").ToString
                    strBal = CDec(rdr("txBalance"))
                    dgvTX.Columns(3).DefaultCellStyle.Format = "N"
                    dgvTX.Columns(6).DefaultCellStyle.Format = "N"
                    'dgvTX.Columns(6).DefaultCellStyle.Format = "C"'Adds the $ sign and commas
                    dgvTX.Rows.Add(intID, strDate, strTxType, strAmt, strCKNum, strDesc, strBal, emptyStr)
                    Dim dateToday = Date.Today


                    Dim lblDate As String = dateToday.ToString("MMM" & " " & "d" & " " & "yyyy")
                    lblAmt.Text = "Current Balance  " & lblDate
                    tbBal.Text = "$ " & String.Format("{0:n}", strBal)
                    rowCount = rowCount + 1
                End While

                dgvTX.Sort(dgvTX.Columns(0), ListSortDirection.Descending)
                If rowCount <= 25 Then
                    maxRowCount = 25 - rowCount
                    For iA = 1 To maxRowCount
                        dgvTX.Rows.Add(" ")
                    Next
                End If
                rdr.Close()
            End Using
        End Using
        conn.Close()
    End Using
    tbBal.Focus()

End Sub

此代码决定使用哪个子路由

    Private Sub frmViewTX_Load(sender As Object, e As EventArgs) Handles MyBase.Load
    StyleDGV()

    If gvTEST Is "All" Then
        PopulateDGV()
    ElseIf gvTEST Is "MoYr" Then
        JustOne()
    ElseIf gvTEST Is "Year" Then
        YearOnly()
    ElseIf gvTEST Is "TxMoYr" Then
        TxMoYr()
    ElseIf gvTEST Is "MoRangeYr" Then
        MoRangeYr()
    End If
    'MoRangeYr
End Sub

【问题讨论】:

  • 参数化您的查询!使用字符串操作将您的数据放入 SQL 是您明年发现六个月前被黑客入侵的方法。
  • 没关系。即使您尝试运行 SELECT 查询,我仍然可以使用注入来插入数据。
  • 也就是说,如果您的查询有不同的用途,我会更倾向于使用或不使用重载的特定功能。
  • @Vector 当一个拥有 368K 声望点的评论者告诉你使用参数时,请相信它。稍后您将了解原因。
  • @Mary 我特别同意他们以教书为生 希望你还在玩桥牌 很高兴在这里见到你 我的支票簿应用程序几乎完成 需要找到一个有新挑战的新项目

标签: vb.net sqlite using


【解决方案1】:

正如我已经说过的,确保使用参数化查询!顺便说一句,这个问题的基本答案是您可以在创建 SQLiteCommand 对象和实际运行命令之间更改 CommandText 属性:

Private Sub MoRangeYr()
 
    Using conn As New SQLiteConnection($"Data Source = '{gv_dbName}';Version=3;")
    Using cmd As New SQLiteCommand("",conn)
        
        If gvTEST = "ALL" Then
            cmd.CommandText = "SELECT * FROM TxData"
        Else If gvTEST = "MoYr" Then
            cmd.CommandText = "SELECT * FROM TxData WHERE txSearchMonth = $gvFromMonth' AND txYear = $gvYear " 
            cmd.Parameters.AddWithValue("$gvFromMonth", gvFromMonth)
            cmd.Parameters.AddWithValue("$gvYear", gvYear)
        Else If gvTEST = "TxMoYr" Then
            cmd.CommandText = "SELECT * FROM TxData WHERE txType = $gvTxType AND txSearchMonth = $gvFromMonth AND txYear = $gvYear "
            cmd.Parameters.AddWithValue("$gvTxType", gvTxType)
            cmd.Parameters.AddWithValue("$gvFromMonth", gvFromMonth)
            cmd.Parameters.AddWithValue("$gvYear", gvYear)
        Else If gvTEST = "MoRangeYr" Then
            cmd.CommandText = "SELECT * FROM TxData WHERE txYear = $gvYear "
            cmd.Parameters.AddWithValue("$gvYear", gvYear)
        End If   

        conn.Open()
        Using rdr As SQLite.SQLiteDataReader = cmd.ExecuteReader
            dgvTX.DataSource = rdr

             dgvTX.Columns(3).DefaultCellStyle.Format = "N"
             dgvTX.Columns(6).DefaultCellStyle.Format = "N"
        End Using

        lblAmt.Text = $"Current Balance  {DateTime.Today:MMMM d yyyy}"
        ' tbBal.Text = "${strBal:n}" ' This was wrong in the original code

        dgvTX.Sort(dgvTX.Columns(0), ListSortDirection.Descending)

    End Using
    End Using
End Sub

您可能还想查看 DataBinding 这个结果。您正在编写大量额外的代码来完成工作,GridView 知道如何为您做。还有一件事:不要在末尾添加dgvTX.Sort(),而是尝试将ORDER BY 添加到首先为您提供该顺序的SQL 中。

【讨论】:

  • 我正在使用 DataBinding,但开始使用样式化 DGV 感谢您的教育我希望您的学生喜欢您的教学和知识库
猜你喜欢
  • 2020-06-12
  • 2021-12-06
  • 2017-06-30
  • 1970-01-01
  • 1970-01-01
  • 2013-11-14
  • 1970-01-01
  • 1970-01-01
相关资源
最近更新 更多