Question

public partial class HardwareInformation : BaseForm
{
    string sWhere = "";
    public HardwareInformation()
    {
        InitializeComponent();
    }

    private void button1_Click(object sender, EventArgs e)
    {
        SqlConnection objConn1 = new SqlConnection("Data Source=192.168.0.203;Initial Catalog=costing;User ID=sa;Password=Spareage@123");
        if ( searchtextbox.Text.Trim() != "" )
        {
            sWhere = "Where  Srno   " + searchtextbox.Text;      
        }

        SqlDataAdapter objAdapter = new SqlDataAdapter(@"Select distinct [Srno] ,[Employee Name] ,  [Department] ,  [Thin Client] , [Desktop] , [Lcd] , [Moniter] , [Printer] , [Ups]   from  [dbo].[HardwareDetail] " + sWhere + "", objConn1);
        DataTable objTable = new DataTable();
        objAdapter.Fill(objTable);
        dataGridView1.DataSource = objTable;
        dataGridView1.Columns[0].Width = 25;
        for (int i = 1; i < dataGridView1.Columns.Count; i++)
        {
            dataGridView1.Columns[i].ReadOnly = true;
        }
    }

Answer 1

使用使用

"Where Srno =  " + searchtextbox.Text + " ";

您忘记了在 srno 后签名, 并在文本框文本后关闭单个引号。

在创建 SqlDataAdapter 的行中, 最后一次使用

 "[Ups] from [dbo].[HardwareDetail] " + sWhere, objConn1);

和 BTW 请注意 < 强 > SQL 喷射。

Answer 2

在文本框文本后缺少 = = 符号缺失,尾引号缺失。因此它应该是

"Where  Srno =  " + searchtextbox.Text +" ";

Answer 3

您的代码很容易被 < a href=" http:// en.wikipedia. org/ wiki/ SQL_injection" rel=“ no follow” >SQL 喷射攻击。您应该 < enger > never 直接插入用户输入到您的 SQL 中, 而不清理它。您真的需要更改为参数查询 :

SqlDataAdapter objAdapter = new SqlDataAdapter(@"Select distinct [Srno] ,[Employee Name] ,  [Department] ,  [Thin Client] , [Desktop] , [Lcd] , [Moniter] , [Printer] , [Ups]   from  [dbo].[HardwareDetail] WHERE Srno = @srno", objConn1);

// Change the length and dbtype to match your needs
objAdapter.Parameters.Add("@srno", SqlDbType.NChar, 15, searchtextbox.Text);

DataTable objTable = new DataTable();
objAdapter.Fill(objTable);

也消除了逃避引言和其他特殊人物的需要。

友情链接