在 VB.Net 中填充 ListView

Question

在 ListView 中显示两个表中的数据的代码（代码工作完美）：

#Region "FillListView"
    Sub FillListview()
        LV.Items.Clear()
        myqry = "SELECT AccResult.StudNo,AccResult.CNumber,AccResult.FirstName,AccResult.LastName,AccResult.YrandSec,Exercises.Exer1,Exercises.Exer2,Exercises.Exer3,Exercises.Exer4,Exercises.Exer5 from AccResult INNER JOIN Exercises ON AccResult.StudNo = Exercises.StudNo ORDER BY AccResult.FirstName,AccResult.YrandSec Asc;"

        mycmd = New OleDbCommand(myqry, con)
        con.Open()
        mydr = mycmd.ExecuteReader
        While mydr.Read
            With LV
                .Items.Add(mydr("StudNo"))
                With .Items(.Items.Count - 1).SubItems
                    .Add(mydr("CNumber"))
                    .Add(mydr("FirstName"))
                    .Add(mydr("LastName"))
                    .Add(mydr("YrandSec"))
                    .Add(mydr("Exer1"))
                    .Add(mydr("Exer2"))
                    .Add(mydr("Exer3"))
                    .Add(mydr("Exer4"))
                    .Add(mydr("Exer5"))
                End With
            End With
        End While
        con.Close()
    End Sub
#End Region

填充 ListView 的代码（错误）：

Public Sub PopulateListView()
        Me.LV.Items.Clear()
        Dim OleDr As OleDb.OleDbDataReader
        OleDr = OleDa.SelectCommand.ExecuteReader() <-----< ERROR: The specified field '[StudNo]' could refer to more than one table listed in the FROM clause of your SQL statement.

        Do While OleDr.Read()
            Dim Item As New ListViewItem
            Item.Text = IIf(OleDr.IsDBNull(0), "", OleDr.Item(0))

            For shtCntr = 1 To OleDr.FieldCount() - 1
                If Not OleDr.IsDBNull(shtCntr) Then
                    Item.SubItems.Add(OleDr.Item("CNumber"))
                    Item.SubItems.Add(OleDr.Item("FirstName"))
                    Item.SubItems.Add(OleDr.Item("LastName"))
                    Item.SubItems.Add(OleDr.Item("YrandSec"))
                    Item.SubItems.Add(OleDr.Item("Exer1"))
                    Item.SubItems.Add(OleDr.Item("Exer2"))
                    Item.SubItems.Add(OleDr.Item("Exer3"))
                    Item.SubItems.Add(OleDr.Item("Exer4"))
                    Item.SubItems.Add(OleDr.Item("Exer5"))
                Else
                    Item.SubItems.Add("")

                End If
            Next shtCntr
            Me.LV.Items.Add(Item)
        Loop
    End Sub

搜索代码：

Private Sub BSearch_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles BSearch.Click
        If txtSearch.Text = "" Then
               MsgBox("Please enter keyword to search...", MsgBoxStyle.Information, "Keyword to search...")
            txtSearch.Focus()
            Exit Sub
        End If
        Call OpenConnection()
         With OleDa
            Call Initialized()
            .SelectCommand = New OleDb.OleDbCommand()
            .SelectCommand.CommandText = "SELECT * FROM [AccResult],[Exercises] WHERE StudNo Like '%%" & txtSearch.Text & "%%' or [YrandSec] Like '%%" & txtSearch.Text & "%%' or [LastName] Like '%%" & txtSearch.Text & "%%'" & _
        "Or [FirstName] Like '%%" & txtSearch.Text & "%%' or [Exer1] Like '%%" & txtSearch.Text & "%%' or [Exer2] Like '%%" & txtSearch.Text & "%%' or [Exer3] Like '%%" & txtSearch.Text & "%%'" & _
        "Or [Exer4] Like '%%" & txtSearch.Text & "%%' or [Exer5] Like '%%" & txtSearch.Text & "%%' ORDER By YrandSec, LastName ASC"
            .SelectCommand.Connection = OleCn

            Call PopulateListView()

             If Me.LV.Items.Count >= 1 Then
                 MsgBox(Me.LV.Items.Count & " Record(s) found for " & "( " & Me.txtSearch.Text & " )", MsgBoxStyle.OkOnly, "Record(s) found...")
            Else
                 MsgBox("No record(s) found for " & "( " & Me.txtSearch.Text & " )" & " , please try again... ", MsgBoxStyle.Critical, "No record found...")
                txtSearch.Focus()
                  txtSearch.SelectAll()
            End If
        End With
        Call CloseConnection()

    End Sub

如何在两个数据表中搜索数据后填充列表视图。搜索后它给了我错误。提前谢谢你。

Answer 1

似乎AccResult 和Exercises 两个表都包含一个名为StudNo 的字段，当您在 where 语句中引用该字段时，数据库无法为您确定您所指的字段。

要删除问题，请在字段名称 StudNo 前加上表名，就像您在有效代码中所做的那样

也就是说，请考虑到您使用字符串连接的查询注定要失败。
如果您的搜索词中存在简单的单引号，则代码将失败并出现语法错误。
然后就是Sql Injection这个大问题

With OleDa
    Dim searchTerm = "%" & txtSearch.Text & "%"
    Call Initialized()
    .SelectCommand = New OleDb.OleDbCommand()
    .SelectCommand.CommandText = "SELECT * FROM AccResult INNER JOIN Exercises " & _ 
                                 "ON AccResult.StudNo = Exercises.StudNo " & _
                                 "WHERE AccResult.StudNo Like ? " & _ 
                                 "or [YrandSec] Like ? " & _
                                 "or [LastName] Like ? " & _
                                 "Or [FirstName] Like ? " & _ 
                                 "or [Exer1] Like ? " & _
                                 "or [Exer2] Like ? " & _
                                 "or [Exer3] Like ? " & _
                                 "Or [Exer4] Like ? " & _
                                 "or [Exer5] Like ? " & _ 
                                 "ORDER By YrandSec, LastName ASC"
    .SelectCommand.Parameters.AddWithValue("@p1", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p2", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p3", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p4", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p5", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p6", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p7", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p8", searchTerm)
    .SelectCommand.Parameters.AddWithValue("@p9", searchTerm)
    .SelectCommand.Connection = OleCn
    .......

在这个版本中，我删除了丑陋的字符串连接并使用了参数化查询。该命令更具可读性，并且通配符的连接只需一次完成。不幸的是，OleDb 无法通过名称识别参数，因此我们需要为查询文本中出现的每个占位符 (?) 添加一个参数 (@pX)