MySQL查询替换字符串

Question

I am trying to take a value from my GUI and use it in my query. How can I go about this using C#? I am trying to use the GUI value to replace the 'cid'.

 string query = "SELECT firstname, lastname, quanitybought FROM customers s, beersbought a WHERE exists(SELECT 'x' FROM beersbought b WHERE b.cid = s.cid)";

Is there a way to replace the cids with the value I receive from my GUI? For example Where b.GUIVALUE = s.GUIVALUE.

Answer 1

Have a look at String.Format() as you can easily achieve what you want using something like

string query = string.Format("SELECT firstname, lastname, quanitybought FROM customers s, beersbought a WHERE exists(SELECT 'x' FROM beersbought b WHERE {0} = {1})", bCidUIControl.Text, sCidUIControl.Text);

The above assumes that you have 2 UI Controls (named bCidUIControl and sCidUIControl) such as a TextBox where the parameter values are set/selected.

Just be aware that you should be very defensive in your programming of queries like this to minimise the possibility of SQL injection attacks. Although the above will achieve what you want, you should probably look at replacing these text values with validated type-safe properties within the class though.

Hope this helps?