從一個文本框將數據添加到一個SQL查詢

Question

目前我使用此代碼從數據庫中的數據讀入一個圖表：

Dim Conn As OleDbConnection = New OleDbConnection 
Dim provider = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source =" 
Dim dataFile = "\\sch5409.poole.sch.uk\public\HomeDirs\Students\11\11browningale\My Documents\CornmarketCPDDatabase.accdb" 
'UserGDCNumber = GDCNumber.Text 
Conn.ConnectionString = provider & dataFile 
Conn.Open() 
Dim cmd As OleDbCommand = New OleDbCommand("SELECT [Type Of CPD], [Amount of Hours], [GDC Number] FROM [CPD Table], [Amount of CPD Hours]", Conn) 
Dim dr As OleDbDataReader = cmd.ExecuteReader 
While dr.Read 
    Chart1.Series("Amount of Hours").Points.AddXY(dr("Type Of CPD").ToString, dr("Amount of Hours").ToString) 
End While 
dr.Close() 
cmd.Dispose() 

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text", Conn) 
dr = cmd.ExecuteReader 

問題是這一行：

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text", Conn) 

它工作正常沒有AND [Amount of CPD Hours].[GDC Number] = GDCNumber.Text

我想我的程序要做的是從文本框中讀取數據GDCNumber.Text（我知道我應該先將它分配給一個變量），然後使用t我的查詢中的帽子數據。

這是錯誤消息：

類型「System.Data.OleDb.OleDbException」的未處理的異常出現在system.data.dll

其它信息：沒有用於一個或給定值。更需要的參數」

Answer 1

你的SQL查詢指的是一個叫GDCNumber.Text的事情，但因爲這是對事物的VB.Net它到底意味着什麼到SQL服務器，而不是你想要的東西，如：。

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = " & GDCNumber.Text, Conn) 

這假定GDCNumber只是一個數字。如果它不是那麼你想要：

cmd = New OleDbCommand("SELECT [Type of CPD], [Amount of Hours] FROM [CPD Table], [Amount of CPD Hours] WHERE [CPD Table].[CPD ID] = [Amount of CPD Hours].[CPD ID] AND [Amount of CPD Hours].[GDC Number] = '" & GDCNumber.Text & "'", Conn) 

這是簡單的解決方案。然而，像這樣構建SQL確實會讓你感到一種被稱爲SQL注入攻擊的東西 - 即某人可能在該文本框中編寫正確的SQL代碼並導致代碼中的各種破壞。要解決此問題，您應該瞭解參數化查詢。