类在按钮单击时不读取表单输入

Question

我有一个类，它接受搜索输入并使用它来查询数据库表。 但是，当我按下按钮并调用类时，我看到它显示输入框中没有任何内容，并且只显示我的 messageBox 消息，上面写着无效的搜索输入（不满足任何输入）。

我怎样才能让班级在正确的时间阅读表单搜索文本框中的内容，以便它可以处理更多信息以继续其功能。

这是该类的代码：

public  static string s;
    public static updateEmployeeForm uF = new updateEmployeeForm();
    public static void selectAndDisplay()
    {

        if ((uF.textID.Text.Length==0))
        {
            MessageBox.Show("Enter valid input to search by");
        }
        else
        {
            try
            {
                if (uF.textID.Text.Length > 0)
                {
                    s = "select * FROM mydb.employees WHERE id =" + int.Parse(uF.textID.Text);//declare variable called column that will contain a table column name set to be updated.

                    uF.colName = "id";
                    uF.updatingVar = uF.textID.Text;
                    uF.query4 = "Update mydb.employees SET name ='" + uF.nameTextBoxU.Text + "', surname='" + uF.surnameTextBoxU.Text + "', dept='" + uF.deptTextBoxU.Text + "', cost_center='" + uF.costCeTextBoxU.Text + "' ,address = '" + uF.addressTextBoxU.Text + "', dob= '" + uF.dobTextBoxU.Text + "',  tel1= '" + uF.tel1TextBoxU.Text + "', tel2= '" + uF.tel2TextBoxU.Text + "' ,tel3= '" + uF.tel3TextBoxU.Text + "', email= '" + uF.emailTextBoxU.Text + "', commission= '" + uF.commTextBoxU.Text + "', total_commission= '" + uF.totalCommTextBoxU.Text + "', sick_leave= '" + uF.sickLTextBoxU.Text + "', annual_leave= '" + uF.annualLTextBoxU.Text + "',  family_leave= '" + uF.familyLTextBoxU.Text + "', other_leave= '" + uF.otherLTextBoxU.Text + "',client_care_access='" + uF.clientCareChBox.Checked + "', sale_system_access='" + uF.StaffSystChBox.Checked + "', sale_system_access ='" + uF.SalesSystChBox.Checked + "', uploads_access='" + uF.UploadsChBox.Checked + "' WHERE id= '" + uF.updatingVar + "';";
                }

                else if (uF.idNumSearchTxtBox.Text.Length > 0)
                {
                    s = "select * FROM mydb.employees WHERE id_num ='" + uF.idNumSearchTxtBox.Text + "';";
                    uF.colName = "id_num";
                    uF.updatingVar = uF.idNumSearchTxtBox.Text;
                    uF.query4 = "Update mydb.employees SET name ='" + uF.nameTextBoxU.Text + "', surname='" + uF.surnameTextBoxU.Text + "', dept='" + uF.deptTextBoxU.Text + "', cost_center='" + uF.costCeTextBoxU.Text + "' ,address = '" + uF.addressTextBoxU.Text + "', dob= '" + uF.dobTextBoxU.Text + "',  tel1= '" + uF.tel1TextBoxU.Text + "', tel2= '" + uF.tel2TextBoxU.Text + "' ,tel3= '" + uF.tel3TextBoxU.Text + "', email= '" + uF.emailTextBoxU.Text + "', commission= '" + uF.commTextBoxU.Text + "', total_commission= '" + uF.totalCommTextBoxU.Text + "', sick_leave= '" + uF.sickLTextBoxU.Text + "', annual_leave= '" + uF.annualLTextBoxU.Text + "',  family_leave= '" + uF.familyLTextBoxU.Text + "', other_leave= '" + uF.otherLTextBoxU.Text + "',client_care_access='" + uF.clientCareChBox.Checked + "', sale_system_access='" + uF.StaffSystChBox.Checked + "', sale_system_access ='" + uF.SalesSystChBox.Checked + "', uploads_access='" + uF.UploadsChBox.Checked + "' WHERE id_num= '" + uF.updatingVar + "';";
                }
                else if (uF.nameSearchTextBox.Text.Length > 0)
                {
                    s = "select * FROM mydb.employees WHERE name ='" + uF.nameSearchTextBox.Text + "';";
                    uF.colName = "name";
                    uF.updatingVar = uF.nameSearchTextBox.Text;
                    uF.query4 = "Update mydb.employees SET name ='" + uF.nameTextBoxU.Text + "', surname='" + uF.surnameTextBoxU.Text + "', dept='" + uF.deptTextBoxU.Text + "', cost_center='" + uF.costCeTextBoxU.Text + "' ,address = '" + uF.addressTextBoxU.Text + "', dob= '" + uF.dobTextBoxU.Text + "',  tel1= '" + uF.tel1TextBoxU.Text + "', tel2= '" + uF.tel2TextBoxU.Text + "' ,tel3= '" + uF.tel3TextBoxU.Text + "', email= '" + uF.emailTextBoxU.Text + "', commission= '" + uF.commTextBoxU.Text + "', total_commission= '" + uF.totalCommTextBoxU.Text + "', sick_leave= '" + uF.sickLTextBoxU.Text + "', annual_leave= '" + uF.annualLTextBoxU.Text + "',  family_leave= '" + uF.familyLTextBoxU.Text + "', other_leave= '" + uF.otherLTextBoxU.Text + "',client_care_access='" + uF.clientCareChBox.Checked + "', sale_system_access='" + uF.StaffSystChBox.Checked + "', sale_system_access ='" + uF.SalesSystChBox.Checked + "', uploads_access='" + uF.UploadsChBox.Checked + "' WHERE name= '" + uF.updatingVar + "';";
                }
                else if (uF.surnameSearchTextBox.Text.Length > 0)
                {
                    s = "select * FROM mydb.employees WHERE surname ='" + uF.surnameSearchTextBox.Text + "';";
                    uF.colName = "surname";
                   uF.updatingVar = uF.surnameSearchTextBox.Text;
                    uF.query4 = "Update mydb.employees SET name ='" + uF.nameTextBoxU.Text + "', surname='" + uF.surnameTextBoxU.Text + "', dept='" + uF.deptTextBoxU.Text + "', cost_center='" + uF.costCeTextBoxU.Text + "' ,address = '" + uF.addressTextBoxU.Text + "', dob= '" + uF.dobTextBoxU.Text + "',  tel1= '" + uF.tel1TextBoxU.Text + "', tel2= '" + uF.tel2TextBoxU.Text + "' ,tel3= '" + uF.tel3TextBoxU.Text + "', email= '" + uF.emailTextBoxU.Text + "', commission= '" + uF.commTextBoxU.Text + "', total_commission= '" + uF.totalCommTextBoxU.Text + "', sick_leave= '" + uF.sickLTextBoxU.Text + "', annual_leave= '" + uF.annualLTextBoxU.Text + "',  family_leave= '" + uF.familyLTextBoxU.Text + "', other_leave= '" + uF.otherLTextBoxU.Text + "',client_care_access='" + uF.clientCareChBox.Checked + "', sale_system_access='" + uF.StaffSystChBox.Checked + "', sale_system_access ='" + uF.SalesSystChBox.Checked + "', uploads_access='" + uF.UploadsChBox.Checked + "' WHERE surname= '" + uF.updatingVar + "';";
                }

这里的代码调用它的形式是我调用它：

    private void btnSearch_Click(object sender, EventArgs e)
    {
        updatingDatareadingClass.selectAndDisplay();
    }

Answer 1

您正在创建表单的新实例，而不是使用原始实例（输入值将存储在哪里）。

您可以使用原始文本框值 textID.Text 或通过以下方式确保您的 uF 表单正在显示：

uf.Show(); // This will then allow you to use `uF.textID.Text` correctly. 

此外，您应该阅读 SQL 注入，因为您的表单是可注入的，例如，用户可以输入他们的姓名为 test or 1 = 1，这将允许随后访问您的应用程序，或者更糟糕的是，DROP TABLE mydb.employees; 这将删除您的所有员工桌子。