数据库到声明的变量

Question

I do want to pass StudName contents to my declared variable. i tried " +a.ToString+" But still i got errors

string a;

connection.Close();
connection.Open();
String strSQL = "select *from Students where StudName = '"  +a.ToString() + "' and StudNum = '" + studentNumber;
OleDbCommand command = new OleDbCommand(strSQL);

Answer 1

StudNum = '" + studentNumber

The Database column for studentNumber is numeric but you're half treating it as alphanumeric.

Solution

StudNum = " + studentNumber

You need to use Parameterised commands to protect against an SQL Injection attack . This will also solve issues such as variables containing apostrophes and etc that would also cause your sql to fail.