【问题标题】:Conversion failed when converting the varchar value from int conversation从 int 对话转换 varchar 值时转换失败
【发布时间】:2019-08-06 11:48:13
【问题描述】:

我有一个在下拉选定条件中过滤的查询:

protected void Get_Data()
{
    try
    {
        string str = "";
        DataTable dt = new DataTable();
        str = "SELECT ROW_NUMBER() OVER (ORDER BY RowId DESC)AS RowNumber,p.CampaignName,";
        str += "p.MobileNo,";
        str += "p.Message,";
        str += "p.CharCount,";
        str += "p.strSenderID as Sender,";
        str += "u.strUserName as UserId,";
        str += "ds.strDR as DeliveryStatus,";
        str += "ds.strDiscription as Original_DRStatus,";
        str += "m.strMessageType as MessageType,";
        str += "CONVERT(varchar(20), p.ReceiveTime) as ReceiveTime,";
        str += "CONVERT(varchar(20), p.SendTime) as SendTime,";
        str += "CONVERT(varchar(20), p.DoneTime) as DoneTime,";
        str += "p.RootId as Root,";
        str += "sp.ProviderName,";
        str += "(CASE intAccountType WHEN 1  THEN 'Promotional' WHEN 2 THEN 'Transactional' WHEN 3 THEN 'OptIn' END)  as AccountType";
        str += " INTO ##Results3 ";
        //str += " FROM NEWSMSLOG_2019_01..LOG_010119  p ";
        str += " FROM NEWBULKSMS.dbo.LOG_010119  p ";
        str += " INNER JOIN deliverstatus ds ON p.DeliveryStatus = ds.intDR_status inner join users u on u.id = p.userid";
        str += " left join senderids b on b.id = p.senderid";
        str += " left join messagetype m on m.intcode = p.messagetype";
        str += " left join smppproviders sp on sp.RootId = p.RootId";
        str += " where 1 = 1 ";

        if(ddl_users.SelectedItem.Text.ToString() == "All")
        {
            str += string.Empty;
        }
        else
        {
            str += " and p.userid = ' + CONVERT(INT,"+ Convert.ToInt32(ddl_users.SelectedValue.ToString())+") + '";
        }

        if (ddl_sender.SelectedItem.Text.ToString() == "All")
        {
            str += string.Empty;
        }
        else
        {
            str += " and p.Senderid = '+CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+")+'";
        }

        if(!string.IsNullOrEmpty(txt_mobileno.Text.Trim()))
        {
            str += " and p.MobileNo like '' % '"+txt_mobileno.Text.Trim()+"' % ''";
        }
        else
        {
            str += string.Empty;
        }

        if(ddl_delevery.SelectedItem.Text.ToString() =="All")
        {
            str += string.Empty;
        }
        else
        {
            str += " and p.Deliverystatus in ('+CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+")+')'";
        }

        if(!string.IsNullOrEmpty(txt_CompaignName.Text.Trim()))
        {
            str += " and p.CampaignName like ''%'"+txt_CompaignName.Text.Trim()+"'%'' '";
        }
        else
        {
            str += string.Empty;
        }

        if(ddl_account.SelectedItem.Text.ToString() == "All")
        {
            str += string.Empty;
        }
        else
        {
            str += " and p.accounttype = '+CONVERT(INT,"+ Convert.ToInt32(ddl_account.SelectedValue.ToString())+")+'";
        }

        obj.Execute_Query(str);

        string str1 = " SELECT * FROM ##Results3";
        //str1 += " SELECT";
        //str1 += " CampaignName,MobileNo,Message,CharCount,Sender,UserId,DeliveryStatus,";
        //str1 += "Original_DRStatus,MessageType,ReceiveTime,SendTime,DoneTime,Root,ProviderName,AccountType";
        //str1 += " FROM ##Results3";
        //str1 += " WHERE RowNumber BETWEEN('1' - 1) * '500' + 1 AND((('1' - 1) * '500' + 1) + '500') - 1";

        dt = obj.Get_Data_Table_From_Str(str1);
        string str2 = " DROP TABLE ##Results3";
        obj.Execute_Query(str2);

        ViewState["data"] = dt;

        egrd.DataSource = dt;
        egrd.DataBind();

        ViewState["data"] = dt;
    }
    catch (Exception ex)
    {
        CommonLogic.SendMailOnError(ex);
    }
}

现在错误就像我将选定文本从下拉列表传递到列变量时一样。这里显示一个错误:

将 varchar 值 ' + CONVERT(INT,2) + ' 转换为数据类型 int 时转换失败。

请帮帮我..

【问题讨论】:

  • 很抱歉,您的代码存在安全隐患。请阅读 SQL 注入和参数化查询。
  • @ZoharPeled 这是一个小型项目,限制访问的用户数量有限。

标签: sql-server tsql c#-4.0 asp.net-4.0


【解决方案1】:

您将 sql Convert 方法放在引号中,以便在您的 sql 代码中将它们检测为 varchar 值。比如下面的代码:

str += " and p.userid = ' + CONVERT(INT,"+ Convert.ToInt32(ddl_users.SelectedValue.ToString())+") + '";

你需要把Convert方法前后的' ++ '去掉,改成这样:

str += " and p.userid = CONVERT(INT,"+ Convert.ToInt32(ddl_users.SelectedValue.ToString())+")";

还有这三行:

str += " and p.Senderid = '+CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+")+'";
str += " and p.Deliverystatus in ('+CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+")+')'";
str += " and p.accounttype = '+CONVERT(INT,"+ Convert.ToInt32(ddl_account.SelectedValue.ToString())+")+'";

必须改为:

str += " and p.Senderid = CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+")";
str += " and p.Deliverystatus in (CONVERT(INT,"+ Convert.ToInt32(ddl_sender.SelectedValue.ToString())+"))'";
str += " and p.accounttype = CONVERT(INT,"+ Convert.ToInt32(ddl_account.SelectedValue.ToString())+")";

您在LIKE 部分也有额外的引号,例如:

 str += " and p.MobileNo like '' % '"+txt_mobileno.Text.Trim()+"' % ''";

必须改为:

str += " and p.MobileNo like '%"+txt_mobileno.Text.Trim()+"%'";

您可以简单地调试您的代码并查看 sql 代码是如何创建的,然后为了更容易修复,您可以将其复制到 sql server 查询编辑器并检查语法。

【讨论】:

  • 你可以简化 LIKE 以进行全文搜索。请
猜你喜欢
  • 2011-05-01
  • 1970-01-01
  • 2020-06-25
  • 2013-02-18
  • 1970-01-01
相关资源
最近更新 更多