在 C# 中从数据库中获取相同的列但不同的值

Question

我正在尝试根据数据库中的equipment 和plant 选择获得顶部3 安全数据行。现在我可以通过设备和植物选择从数据库中获取前 3 位安全值并插入到文本框中。

当我写 "' or Safety '" + textbox.text + 时，它正在获得其他工厂和设备选择

sqlcon1.Open();

SqlDataAdapter Data = new SqlDataAdapter (@"select * from ****** Where " 
    + "[Equipment Type]='" + equipmenttype_combobox.Text.Trim() 
    + "' and Plant='"   + plant_combobox.Text.Trim() 
    + "' and Safety= '" + firstsafety_textbox.Text.Trim() 
    + "' or Safety='"   + secondsafety_textbox.Text.Trim() 
    + "' or Safety='"   + thirdsafety_textbox.Text.Trim() + "'", sqlcon);

DataTable dt1 = new DataTable();
SqlDataAdapter db1 = new SqlDataAdapter();
Data.Fill(dt1);

datagridview1.DataSource = dt1;

sqlcon1.Close();

Answer 1

借助逐字字符串和字符串插值让你的sql保持可读，许多错误将很明显。在这里，您应该将Safety = ... or Safety = ... 括在括号(Safety = ... or Safety = ... ) 中或使用in 构造Safety in (...)。

快速但脏修正是

...
string sql = $@"select * 
                  from Makerinfo 
                 where [Equipment Type] = '{equipmenttype_combobox.Text.Trim()}' 
                   and [Plant]          = '{plant_combobox.Text.Trim()}'
                   and [Safety]       in ('{firstsafety_textbox.Text.Trim()}', 
                                          '{secondsafety_textbox.Text.Trim()}', 
                                          '{thirdsafety_textbox.Text.Trim()}')";

SqlDataAdapter Data = new SqlDataAdapter(sql, sqlcon1);

...

然而，这个实现有至少 3 缺陷：

1. 容易发生 SQL 注入
2. 它将在equipmenttype_combobox.Text = "Browns' equipment" 上崩溃（注意撇号）
3. 对于不同的植物，您有不同的查询，应该解析、优化等。

更好的方法是参数化查询：

...

string sql = $@"select * 
                  from Makerinfo 
                 where [Equipment Type] = @prm_Equipment 
                   and [Plant]          = @prm_Plant
                   and [Safety]       in (@prm_Safety_1, @prm_Safety_2, @prm_Safety_3)";

using (SqlCommand q = new SqlCommand(sql, sqlcon1)) {
  // I don't know the underlying RDMBS types, that's why I've put AddWithValue
  //TODO: change AddWithValue to Add and provide the right rdbms type 
  // Something (and most probably) like
  //  q.Parameters.Add("@prm_Equipment", SqlDbType.VarChar).Value = 
  //    plant_combobox.Text.Trim();
  q.Parameters.AddWithValue("@prm_Equipment", equipmenttype_combobox.Text.Trim());
  q.Parameters.AddWithValue("@prm_Plant",     plant_combobox.Text.Trim());
  q.Parameters.AddWithValue("@prm_Safety_1",  firstsafety_textbox.Text.Trim());
  q.Parameters.AddWithValue("@prm_Safety_2",  secondsafety_textbox.Text.Trim());
  q.Parameters.AddWithValue("@prm_Safety_3",  thirdsafety_textbox.Text.Trim());  

  using (var reader = q.ExecuteReader()) {
    DataTable dt1 = new DataTable();
    dt1.Load(reader);
    datagridview1.DataSource = dt1;
  }
}

...