以下查询出了什么问题？

Question

I have a table containing name, surname and email. I want to retrieve them from the table and so i write:

if (LoginAs.SelectedValue == "Administrator")
{
    string result;
    string query = "Select * from AdminTable where ID='"+ idBox.Text +"'";
    cmd1 = new SqlCommand(query, con);
    result = Convert.ToString(cmd1.ExecuteScalar());

    Response.Redirect("Admin.aspx");
    //Admin user = new Admin(idBox.Text, "Active",  mail, firstName, LastName, passwordBox.Text);
}

The problem is, it only returns the name field of the specified row even though i wrote "Select *". What is wrong here?

Answer 1

You must try ExecuteReader() instead of using ExecuteScalar()

ExecuteScaler is used in situation where we have to read a single value.eg:

select count(*) from tablename.

while

ExecuteReader is used for any result set with multiple rows/columns (eg, SELECT * from TableName)

Answer 2

ExecuteScalar returns just the first column of the first row, and ignores the rest.

So you should use ExecuteReader method. An example from MSDN:

using (SqlConnection connection = new SqlConnection(
           connectionString))
{
    connection.Open();

    SqlCommand command = new SqlCommand(queryString, connection);
    SqlDataReader reader = command.ExecuteReader();
    while (reader.Read())
    {
        Console.WriteLine(String.Format("{0}", reader[0]));
    }
}

Note that the while (reader.Read()) checks whether your query returned (more) results and positions the cursor on the next record, that you can then read. This example prints the first column's value.
The using statement makes sure the connection is closed after use, whatever happens.

Also, don't build your query directly with input from the user (such as the value of a TextBox), use parameters instead to prevent SQL injection attacks.

Answer 3

Sample code:

 string myQuery="Select * from AdminTable where ID=@myid";
 SqlCommand cmd=new SqlCommand(myQuery,conn);
 cmd.Parameters.AddWithValue("@myid", value);
 conn.Open();
 SqlDataReader dreader;
 dreader = cmd.ExecuteReader(CommandBehavior.CloseConnection);
 while (dreader.Read())
 {
    string Value1= dreader["COl1"].ToString();
    string Value2= dreader["COl2"].ToString();
 }  
 dreader.Close(); 

Always use parameterized Query

Answer 4

您可以尝试使用cmd1.ExecuteReader() 。