如何将变量连接到SqlCeCommand？

Question

I'm taking a C# course at the moment and am trying to get some data from my database.

In my public function I have a local variable: string genre = "drama";

Now I want to concatenate that variable to my SqlCeCommand:

SqlCeCommand command = new SqlCeCommand("SELECT * FROM Movie WHERE Genre =" + genre, connection);

But I am not able to.

So my question is: How do I append, or concatenate a variable to a SqlCeCommand?

Answer 1

SqlCeCommand command = new SqlCeCommand("SELECT * FROM Movie WHERE Genre = @genre", connection);
command.Parameters.AddWithValue("@genre", genre);

your first attempt was close ,and can work if the syntax is fixed, but using parameters will help prevent injection attacks, which can be very bad.

Answer 2

You should always use SQL parameters instead of string concatenation, to prevent SQL injection. In your case, this will also make it easier for you to write a valid SQL query:

SqlCeCommand command = new SqlCeCommand("SELECT * FROM Movie WHERE Genre = @genre", connection);
command.Parameters.AddWithValue("@genre", genre);

Answer 3

Use parameters

  SqlCeCommand cmd = new SqlCeCommand("SELECT * FROM Movie WHERE Genre = @genre", conn));
  cmd.Parameters.Add(new SqlCeParameter("@genre", genre));