如何从asp.net vb.net中的sql查询中的对象获取值答案

【问题标题】：How to get values from an object in sql query in asp.net vb.net如何从asp.net vb.net中的sql查询中的对象获取值
【发布时间】：2021-12-09 19:08:46
【问题描述】：

我想运行一个选择命令，并且我有一个填充了数据库表名的下拉列表。如何编写选择命令？这是我的代码

        Dim da As New OdbcDataAdapter("select table_name from INFORMATION_SCHEMA.tables WHERE TABLE_TYPE = 'BASE TABLE' and table_schema='public'", dbcon.con)
        Dim dt As New DataTable
        da.Fill(dt)
        ddltablename.DataSource = dt
        ddltablename.DataTextField = "table_name"
        ddltablename.DataValueField = "table_name"
        ddltablename.DataBind()

    End Sub
 Protected Sub btndump_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btndump.Click
  Dim da As New OdbcDataAdapter("select * from ddltablename.SelectedItem.tostring", dbcon.con)
  Dim ds As New DataSet
  da.Fill(ds)
  End Sub

【问题讨论】：

标签： asp.net postgresql vb.net

【解决方案1】：

当然，让我们放入您的组合框，然后放入一个网格视图。

像这样：

    <asp:DropDownList ID="cboTables" runat="server" Height="31px" Width="179px"
        DataTextField ="table_name"
        DataValueField ="table_name" Rows="50" >
    </asp:DropDownList>


    <asp:Button ID="cmdShowTables" runat="server" Text="Show Selected table" Width="175px" style="margin-left:25px"/>
    <br />
    <br />


    <asp:GridView ID="GridView1" runat="server"></asp:GridView>

因此我们的代码可以是：

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

    If Not IsPostBack Then

        Dim strSQL As String =
            "SELECT table_name from INFORMATION_SCHEMA.tables " &
            "WHERE TABLE_TYPE = 'BASE TABLE' ORDER BY table_name"

        cboTables.DataSource = MyRst(strSQL)
        cboTables.DataBind()

    End If

End Sub

Protected Sub cmdShowTables_Click(sender As Object, e As EventArgs) Handles cmdShowTables.Click

    Dim rst As New DataTable
    rst = MyRst("SELECT * from " & cboTables.SelectedItem.Value)
    'GridView1.DataSource
    GridView1.DataSource = rst
    GridView1.DataBind()

End Sub


Function MyRst(strSQL As String) As DataTable

    Dim rstData As New DataTable

    Using conn As New OdbcConnection(My.Settings.TEST3ODBC)
        Using cmdSQL As New OdbcCommand(strSQL, conn)
            conn.Open()
            rstData.Load(cmdSQL.ExecuteReader)
        End Using
    End Using

    Return rstData

End Function

输出：

或者你可以说这样做：

    Dim rst As New DataTable
    rst = MyRst("SELECT * from " & cboTables.SelectedItem.Value)
    For Each OneRow as DataRow in rst.rows
        debug.print ("Hotel Name = " & OneRow("HoteName").ToString())
    Next

【讨论】：

【解决方案2】：

大概是这样的：

Protected Sub btndump_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btndump.Click
  Dim tableName = ddltablename.SelectedItem.ToString();
  ' It would be prudent to create a function to verify table names against a 
  ' whitelist before sending it, since generating a sql command 
  ' using string concatenation carries the risk of sql injection
  Dim da As New OdbcDataAdapter("select * from " & tableName & ";", dbcon.con)
  Dim ds As New DataSet
  da.Fill(ds)
End Sub

获取控件的值 ddltablename 必须在应用程序上下文中完成，而不是在 SQL 命令中。

【讨论】：