如何在 SQL 命令中使用会话字符串？

Question

我正在尝试使用会话字符串变量作为 SQL 命令中的 WHERE 子句条件，下面是 C# 中的代码

static string strConn = ConfigurationManager.ConnectionStrings["pEAnUtWoRM"].ToString();
SqlConnection conn = new SqlConnection(strConn);

protected void Page_Load(object sender, EventArgs e)
{
        if (!Page.IsPostBack)
        {
            displayProfiles();
        }
}

private void displayProfiles()
{
       if (Session["email"] != null )
       {
            string email = Convert.ToString(Session["email"]);

            SqlCommand cmd = new SqlCommand("SELECT Student.Name FROM Student " +
            "LEFT JOIN Mentor ON Student.MentorID = Mentor.MentorID " +
            "WHERE Mentor.EmailAddr = " + email.ToString(), conn);

            SqlDataAdapter da = new SqlDataAdapter(cmd);

            DataSet result = new DataSet();

            conn.Open();
            da.Fill(result, "StudentProfile");
            conn.Close();

            gvProfileList.DataSource = result.Tables["StudentProfile"];
            gvProfileList.DataBind();
        }
}

连接字符串和SqlConnection 工作正常（它不在方法中），因为我已经在其他aspx 页面上对其进行了测试。错误说：

System.Data.SqlClient.SqlException：无法在da.Fill(result, "StudentProfile");上绑定多部分标识符

Answer 1

抛出异常是因为查询语法不正确，因为email.ToString()的值没有被适当地转义，导致如下查询：

SELECT
    Student.Name
FROM
    Student
LEFT JOIN
    Mentor ON Student.MentorID = Mentor.MentorID
WHERE
    Mentor.EmailAddr = email@outlook.com

我的假设是您的意图是生成以下查询，其中email.ToString() 的值（例如email@outlook.com）在单引号之间：

SELECT
    Student.Name
FROM
    Student
LEFT JOIN
    Mentor ON Student.MentorID = Mentor.MentorID
WHERE
    Mentor.EmailAddr = 'email@outlook.com'

一种可能的解决方法是在 SQL 命令中添加一个参数（例如@EmailAddress）并将电子邮件值分配给它，如下所示：

const string EMAIL_ADDRESS_PARAMETER_NAME = "@EmailAddress";

SqlCommand cmd = new SqlCommand("SELECT Student.Name FROM Student " +
    "LEFT JOIN Mentor ON Student.MentorID = Mentor.MentorID " +
    $"WHERE Mentor.EmailAddr={EMAIL_ADDRESS_PARAMETER_NAME}", conn);

cmd.Parameters.Add(EMAIL_ADDRESS_PARAMETER_NAME, SqlDbType.VarChar).Value = email;