参数作用与普通字符串相同

Question

当我在我的 TextBox 中键入 ' 时，会导致错误。我知道这是因为' 是 SQL 查询的一部分。我该如何避免呢？我已经用 Parameter 完成了，但甚至没有工作。

    private void theFilter(string FilterValue) {
        string thisQuery = "SELECT * FROM [Customer] WHERE CONCAT([Name], [Address], [Discount]) LIKE '%" + @FilterValue + "%'";
        using(SqlConnection thisSqlConnection = new SqlConnection(theConnectionString))
        using(SqlCommand thisSqlCommand = new SqlCommand(thisQuery, thisSqlConnection)) {
            thisSqlCommand.Parameters.AddWithValue("@FilterValue", FilterValue);
            using(SqlDataAdapter thisSqlDataAdapter = new SqlDataAdapter(thisSqlCommand))
            using(DataTable thisDataTable = new DataTable()) {
                thisSqlDataAdapter.Fill(thisDataTable);
                DataGrid_Customer.ItemsSource = thisDataTable.DefaultView;
            }
        }
    }

Answer 1

试试这个

private void theFilter(string FilterValue) {
    string thisQuery = "SELECT * FROM [Customer] WHERE CONCAT([Name], [Address], [Discount]) LIKE @FilterValue";
    using(SqlConnection thisSqlConnection = new SqlConnection(theConnectionString))
    using(SqlCommand thisSqlCommand = new SqlCommand(thisQuery, thisSqlConnection)) {
        thisSqlCommand.Parameters.AddWithValue("@FilterValue", "%" + FilterValue + "%");
        using(SqlDataAdapter thisSqlDataAdapter = new SqlDataAdapter(thisSqlCommand))
        using(DataTable thisDataTable = new DataTable()) {
            thisSqlDataAdapter.Fill(thisDataTable);
            DataGrid_Customer.ItemsSource = thisDataTable.DefaultView;
        }
    }
}

请记住，您在参数中使用字符串，而不是变量。您必须在 AddWithValue 方法中指明“%”才能在查询中使用通配符。

Answer 2

private void theFilter(string FilterValue) {
    string thisQuery = "SELECT * FROM [Customer] WHERE CONCAT([Name], [Address], [Discount]) LIKE @FilterValue";
    using(SqlConnection thisSqlConnection = new SqlConnection(theConnectionString))
    using(SqlCommand thisSqlCommand = new SqlCommand(thisQuery, thisSqlConnection)) {
        thisSqlCommand.Parameters.AddWithValue("@FilterValue", "%" + SqlLikeEscape(FilterValue) + "%");
        using(SqlDataAdapter thisSqlDataAdapter = new SqlDataAdapter(thisSqlCommand))
        using(DataTable thisDataTable = new DataTable()) {
            thisSqlDataAdapter.Fill(thisDataTable);
            DataGrid_Customer.ItemsSource = thisDataTable.DefaultView;
        }
    }
}

// This function is important, since otherwise if there is a % in the table (or other special LIKE characters) then it is hard to search for them
//see https://stackoverflow.com/questions/18693349/how-do-i-find-with-the-like-operator-in-sql-server
public static string SqlLikeEscape(string value)
{
    if (string.IsNullOrEmpty(value)) return value;
    return Regex.Replace(value, @"(?<ch>%|_|\[)", @"[${ch}]");
}