SqlException未处理，语法错误

Question

I have the following problem when performing a query on sqlserver management:

An unhandled exception of type ' System.Data.SqlClient.SqlException ' occurred in System.Data.dll

Additional information : Incorrect syntax near ' u' .

The code is as follows:

---

public static Alumno ObtenerUsuario(String usuarionumero)
        {
            //long Id_int;
            //Id_int = Convert.ToInt64(pId);
            using (SqlConnection conexion = BDComun.ObtnerCOnexion())
            {

                Alumno pAl = new Alumno();
                SqlCommand comando = new SqlCommand(String.Format("Select Id, Nombre, Apellido, Usuario, Cargo, Celular, rfid, Fecha_Nac, Estado, Check_acceso, Empresa_contratista from Alumnos where Id={0}", usuarionumero), conexion);

                SqlDataReader reader = comando.ExecuteReader();

                while (reader.Read())
                {
                    pAl.Nombre = reader.GetString(1);
                    pAl.Apellido = reader.GetString(2);
                    pAl.Usuario = reader.GetString(3);
                    pAl.Cargo = reader.GetString(4);
                    pAl.Celular = reader.GetString(5);
                    //pAl.rfid = reader.GetString(6);
                    pAl.Fecha_Nac = reader.GetString(7);
                    pAl.Estado = reader.GetString(8);
                    pAl.Check_acceso = reader.GetString(9);
                    pAl.Empresa_contratista = reader.GetString(10);
                }
                conexion.Close();
                return pAl;

            }
        }

---

The function: public static Alumno ObtenerUsuario(String usuarionumero) It comes from:

public static Alumno ObtenerUsuario(string prfid)
       {
           int dato_numerico;
           int informacion_de_estado_2 = 0;
           while (prfid.Contains(""))
           {
               prfid = "123456789012";

           }
           while (prfid.Contains(""))
           {
               prfid = "123456789012";
           }
           while (prfid.Contains("~"))
           {
               prfid = "123456789012";  
               informacion_de_estado_2 = 1; // 1 = Acceso Denegado 0 = Acceso permitido para el registro
           }
           while (prfid.Contains("¢")) //¢
           {
               prfid = "123456789012";  
               informacion_de_estado_2 = 1; // 1 = Acceso Denegado 0 = Acceso permitido para el registro
           }

               using (SqlConnection conexion = BDComun.ObtnerCOnexion())
               {

                   Alumno pAlumno = new Alumno();


                   SqlCommand comando = new SqlCommand(string.Format(
                       "Select Id, Nombre,  Apellido, Usuario, Cargo, Celular, rfid, Fecha_Nac, Empresa_contratista from Alumnos where rfid = {0}", prfid), conexion);

                   ////try
                   ////{
                       SqlDataReader reader = comando.ExecuteReader();

                   //}
                   //catch (Exception exp)
                   //{
                   //    //  MessageBox.Show("Por favor inicia registros para habilitar el control.", "Iniciar registros", MessageBoxButtons.OK, MessageBoxIcon.Information);
                   //}

                   while (reader.Read())
                   {
                       pAlumno.Id = reader.GetString(0);
                       pAlumno.Nombre = reader.GetString(1);
                       pAlumno.Apellido = reader.GetString(2);
                       pAlumno.Usuario = reader.GetString(3);
                       pAlumno.Cargo = reader.GetString(4);
                       pAlumno.Celular = reader.GetString(5);
                       pAlumno.rfid = reader.GetString(6);
                       pAlumno.Fecha_Nac = reader.GetString(7);
                       pAlumno.Empresa_contratista = reader.GetString(8);
                       // pAlumno.Fecha_Nac = Convert.ToString(reader.GetDateTime(7));

                   }

                   conexion.Close();
                   return pAlumno;

               }


           }

How can I resolve this problem?

Answer 1

Appending your parameters directly into command text is a bad practice, you make yourself vulnurable to the SQL injection. You can add your variable usuarionumero as a parameter like this

SqlCommand comando = new SqlCommand("Select Id, Nombre, Apellido, Usuario, Cargo, Celular, rfid, Fecha_Nac, Estado, Check_acceso, Empresa_contratista from Alumnos where Id=@Id");
cmd.Parameters.AddWithValue("@id", usuarionumero ); 

This should solve your problem by escaping special characters inside usuarionumero in resulting SQL

Answer 2

If, for whatever reason, you've decided that you don't want to use parameters as described by Alex Buyny, the actual syntax error with your inline query appears to be that you forgot to add single quotes around the value that you're using in your where clause, like so:

                SqlCommand comando = new SqlCommand(String.Format("Select Id, Nombre, Apellido, Usuario, Cargo, Celular, rfid, Fecha_Nac, Estado, Check_acceso, Empresa_contratista from Alumnos where Id='{0}'", usuarionumero), conexion);

Notice that I've changed Id={0} to Id='{0}' .

However, as Alex mentioned, doing queries this way can lead to SQL injection attacks. For instance, consider what happens if someone called your method and passed something like this for usuarionumero :

null'; drop table Alumnos where '1' = '1

As you can see, this could lead to disastrous results.