C＃中的MSSQL查询，从字符串获取WHERE子句的一部分

Question

I am using following code:

string str = "ID = 15";

using (SqlCommand cmd = new SqlCommand("SELECT * " + 
                                       "FROM Cutomer" + 
                                       " Where (Status='Umbruch') and '"+str+"' " , con))

I am getting this error:

near 'ID = 15' is a non boolean expression specified in a context where a condition is expected. 

I know I can use the above code like this:

int id = 15; 

using (SqlCommand cmd = new SqlCommand("SELECT * " + 
                                       "FROM Cutomer" + 
                                       " Where (Status='Umbruch') and (ID='"+str+"')" , con))

It works fine like this but I want to use it as mentioned in first code above. Because the number of IDs is not fixed they can be 2,3 or more. Just for simplicity I put my code here like this.

Answer 1

The first version should be (from your second "working" query, you need simple quotes around 15, not around the entire expression).

str = "ID = '15'";

using (SqlCommand cmd = new SqlCommand("SELECT * " + 
                                       "FROM Cutomer" + 
                                       " Where (Status='Umbruch') and "+str , con))

By the way, you should user Parameters, not direct strings.

If you need an IN clause, you may look at that question

Answer 2

A simple error, do not put single quotes before and after the string

using (SqlCommand cmd = new SqlCommand("SELECT * FROM Cutomer " + 
                                       "WHERE (Status='Umbruch') AND " + str , con))

of course this assumes that your ID field is numeric and not a text field.
In the latter case you should put the single quotes around the 15 constant

string str = "ID = '15'";

As a side note, keep in mind that string concatenation is really dangerous because your code could be exploited with a simple Sql Injection attack. In this very specific case there is no possibility for injection.

If you receive the ID to search for from a user input, do not use string concatenation to build sql commands. Instead use a parameterized query

 using (SqlCommand cmd = new SqlCommand("SELECT * FROM Cutomer " + 
                               " Where (Status='Umbruch') and ID=@custID" , con))
 {
      cmd.Parameters.AddWithValue("@custID", 15);
      ......
 }

Answer 3

You're making it a literal here:

using (SqlCommand cmd = new SqlCommand("SELECT * " + 
                                       "FROM Cutomer" + 
                                       " Where (Status='Umbruch') and '"+str+"' " , con))

It should be:

using (SqlCommand cmd = new SqlCommand("SELECT * " + 
                                       "FROM Cutomer" + 
                                       " Where (Status='Umbruch') and "+str, con))

Note the slight difference in which the ' were removed.

Further, please read through my blog post on why you're open to SQL injection and why you need to leverage parameterized SQL instead of raw SQL.