如何使用C＃3.5运行SQL代码？

Question

I have an HTML textbox that contains some SQL code that I need executed. I am able to retrieve the actual code from the textbox but I am not sure how to go about executing the code. Any simple and elegant ways using c# 3.5?

Answer 1

DON'T EXECUTE CODE FROM A TEXTBOX

unless you really trust what is being entered.

If you do, use this:

SqlConnection con = new SqlConnection("Your connection string");
con.Open();
SqlCommand cmd = new SqlCommand(TexdtBox1.Text, con);
cmd.ExecuteNonQuery();
con.Close()

Note that this will not return anything, jsut run the query. If you want to return data, you need a SqlDataAdaptor or SqlDataReader.

Answer 2

Answer 3

It depends on the type of database you want to execute it against. If I can assume you want to talk to a SQL Server database, look at the following classes:

• SqlConnection class
• SqlCommand class

Answer 4

从文本框中使用CommandText创建SqlCommand 。

Answer 5

here's a little (untested untested because typed right in the SO textbox) sample code:

using System.Data;

namespace MyGreatNamespace
{
    class MyGreatClass
    {
        static public DataTable executeTable( string query )
        {
            return executeTable( query, null, null );
        }

        static public DataTable executeTable( string query, string[] params, object[] values )
        {
                    DataTable myTable = new DataTable();
            using ( SqlConnection connection = new SqlConnection( myConnectionString ) )
            using( SqlCommand command = new SqlCommand( connection ) )
            {
                command.CommandType = CommandType.Text;
                command.CommandText = myQuery;

                if ( parameters.Count == values.Count && parameters.Count > 0 )
                {
                    for( int i = 0; i < parameters.Count; i ++ )
                    {
                        command.addParameterWithValue( parameters[i], values[i] );
                    }
                }

                using( SqlDataAdapter adapter = new SqlDataAdapter( command ) )
                {
                    adapter.Fill( out myTable );
                }
            }
            return myTable;
        }
    }
}

Answer 6

我不建议这样做，但如果这样做，至少要验证输入的SQL以SELECT开头，并且不包含任何分号（;）或注释字符（-和/ *）。