删除按钮 SQL 数据库 Windows 窗体应用程序

Question

如何修改删除按钮代码以从 SQL 数据库中删除选定的行？目前，当我选择一行并单击删除按钮时，所有行都会被删除。

private void delete_button1_Click_1(object sender, EventArgs e)
    {
        if (dataGridView1.SelectedRows.Count > 0)
        {
            int selectedIndex = dataGridView1.SelectedRows[0].Index;
            string sqlquery;
            string ConString = ConfigurationManager.ConnectionStrings["ConString"].ConnectionString;
            MySqlConnection con = new MySqlConnection(ConString);
            con.Open();
            int rowID = int.Parse(dataGridView1[0, selectedIndex].Value.ToString());
            sqlquery = "DELETE FROM hotel_booking WHERE BookingID = BookingID";

            try
            {
                MySqlCommand command = new MySqlCommand(sqlquery, con);
                command.ExecuteNonQuery();
                string CmdString = "SELECT * FROM hotel_booking";
                MySqlDataAdapter sda = new MySqlDataAdapter(CmdString, con);
                DataSet ds = new DataSet();
                sda.Fill(ds);
                dataGridView1.DataSource = ds.Tables[0].DefaultView;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
            }
        }
    }

Answer 1

不要尝试运行此查询，它会删除您的所有行

DELETE FROM hotel_booking WHERE BookingID = BookingID

BookingID = BookingID 表示它总是正确的

我认为你正在尝试使用

int rowID = int.Parse(dataGridView1[0, selectedIndex].Value.ToString());
sqlquery = "DELETE FROM hotel_booking WHERE BookingID = "+ rowID;

Answer 2

由于WHERE 子句中的错误，您当前正在删除所有行：

DELETE FROM hotel_booking WHERE BookingID = BookingID

删除所有行，因为在每一行中BookingID 等于BookingID。

你想以rowID为条件，所以将其添加为参数：

int rowID = int.Parse(dataGridView1[0, selectedIndex].Value.ToString());
sqlquery = "DELETE FROM hotel_booking WHERE BookingID = @rid";   
try
{
    MySqlCommand command = new MySqlCommand(sqlquery, con);
    command.Parameters.Add("@rid", SqlDbType.Int).Value = rowID;
    command.ExecuteNonQuery();

---

请注意，将用户生成的值直接插入您的查询（如"WHERE BookingID = " + rowID...）容易受到SQL Injection 的攻击。虽然对于数字类型来说这不是一个很大的危险，但您通常应该像上面那样使用参数化查询。

Answer 3

你的问题在这里：

sqlquery = "DELETE FROM hotel_booking WHERE BookingID = BookingID"

where 部分始终为真。

改成这样：

sqlquery = "DELETE FROM hotel_booking WHERE BookingID = @BookingID"
try
        {
            MySqlCommand command = new MySqlCommand(sqlquery, con);
            command.Parameters.AddWithValue("@BookingID", rowID);
            command.ExecuteNonQuery();
            ...