C＃生成查询以将DateTime与SQL Nvarchar date列进行比较

Question

I tried to get result depending on two dates which the user checked. I have two datetimepicker controls. I want the user to chooses the "from" date and "to" date, then the query get specific result.

leaving_time column type is nvarchar

This is my query:

SELECT name, mil_no, rotba, arrival_time, leaving_time, day, year
FROM dbo.Hodor_data 
WHERE leaving_time BETWEEN '"+dateTimePicker1.Checked.ToString()+ "' AND  '" + dateTimePicker2.Checked.ToString() + '"

Where is the mistake?

Answer 1

You should write parameterized queries and not using string concatenation for passing the parameters, in order to create a sql command. Using string concatenation makes you code vulnerable to sql injections.

var cmdText = @"SELECT ...
                FROM dbo.Hodor_data
                WHERE leaving_time BETWEEN @StartDate AND @EndDate";

var sqlCommand = new SqlCommand(cmdText, connection);
sqlCommand.Parameters.AddWithValue("@StartDate", dateTimePicker1.Value);
sqlCommand.Parameters.AddWithValue("@EndDate", dateTimePicker2.Value);

where connection is your sql connection object.

Answer 2

尝试在使用dateTimePicker1.Text的dateTimePicker1_ValueChanged事件中使用dateTimePicker2.Checked已检查返回true或false而不是date的值

Answer 3

Checked is a boolean property, and it is not the date. You need to use the Value Property. It is better to add parameters and explicitly specify the type so that the date format conflict is solved.

Edit: If column type in SQL server is NVARCHAR and of format MM/dd/yyyy , you need to use ONVERT(DATETIME, leaving_time, 101) :

conn.Open();
SqlDataAdapter dataAdapter = 
    new SqlDataAdapter("SELECT name, mil_no, rotba, arrival_time, leaving_time, day, year "
                     + "FROM dbo.Hodor_data where CONVERT(DATETIME, leaving_time, 101) "
                     + "BETWEEN @p1 AND @p2", conn);

SqlParameter fromDate = new SqlParameter("@p1", SqlDbType.DateTime2);
fromDate.Value = dateTimePicker1.Value;
SqlParameter toDate = new SqlParameter("@p2", SqlDbType.DateTime2);
toDate.Value = dateTimePicker2.Value;

dataAdapter.SelectCommand.Parameters.Add(fromDate);
dataAdapter.SelectCommand.Parameters.Add(toDate);

DataTable dt = new DataTable();
dataAdapter.Fill(dt);
dataGridView1.DataSource = dt; 
conn.Close()

You should really consider changing the type of column leaving_time to be a DateTime column. This will make your life easier in querying. I can't really see any advantage of storing these values as text.