在 VB.NET 文本框中显示 SQL 列项

Question

我希望 SQL 数据库列的特定值出现在文本框中，但我的代码出现错误，出现在这一行：

Dim lrd As MySqlDataReader = cmd.ExecuteReader()

Imports MySql.Data.MySqlClient

公开课主

Dim conn As MySqlConnection

Private Sub Main_Load(sender As Object, e As EventArgs) Handles Me.Load
    conn = New MySqlConnection()
    conn.ConnectionString = "server='127.0.0.1';user id='root';Password='test';database='snipper'"
    Try
        conn.Open()
    Catch myerror As MySqlException
        MsgBox("Error Connecting to Database. Please Try again !")
    End Try
    Dim strSQL As String = "SELECT * FROM snippets"
    Dim da As New MySqlDataAdapter(strSQL, conn)
    Dim ds As New DataSet
    da.Fill(ds, "snippets")
    With ComboBox1
        .DataSource = ds.Tables("snippets")
        .DisplayMember = "title"
        .SelectedIndex = 0
    End With
    Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title=" & cbSnippets.Text)
    cmd.Connection = conn
    Dim lrd As MySqlDataReader = cmd.ExecuteReader()
    While lrd.Read()
        txtCode.Text = lrd("snippet").ToString()
    End While
End Sub

可能出了什么问题？

Answer 1

尝试更改此行：

Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title=" & cbSnippets.Text)

到：

Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title='" & cbSnippets.Text & "'")

注意您要搜索的字符串周围的引号。您也可以使用like 比较：

Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title like '%" & cbSnippets.Text & "%'")

% 符号充当通配符。在这种情况下，它将查找包含搜索文本的任何字符串，而不是与搜索文本完全相同的字符串。

Answer 2

PLEASE USE PARAMETERISED QUERIES

您的实际问题源于此行：

Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title=" & cbSnippets.Text)

假设我在文本框中输入"This is a test"，SQL变成了

SELECT snippet 
FROM snippets 
WHERE title=This is a test

文本周围没有引号，应该是：

SELECT snippet 
FROM snippets 
WHERE title='This is a test'

但是，如果我在您的文本框中写 "''; DROP TABLE Snippets; -- "，您可能会发现自己没有 sn-ps 表！。

您应该始终使用参数化查询，这样更安全、更高效（这意味着查询计划可以被缓存和重用，因此不需要每次都编译）；

Dim cmd = New MySqlCommand("SELECT snippet FROM snippets where title = @Title")
cmd.Parameters.AddWithValue("@Title", cbSnippets.Text)
Dim lrd As MySqlDataReader = cmd.ExecuteReader()