无法使用ADO.NET连接的架构从SQL Server读取数据

Question

The problem occurs when I try to read data from a local database using SqlDataReader and insert data into a ListBox . I can't get any results, even though I should. The thing is when I run ingilizceSorgusu in SSMS, it works fine, I can retrieve the data into result table. I think there is something that I'm missing about SqlDataReader .

This is my code:

    public partial class Arama : Form
    {
        #region Nesneler
        SqlCommand Sorgu;
        SqlConnection Baglanti;
        SqlDataReader Okuyucu;
        IEnumerator Numarala;
        string baglantiCumlesi = @"Server = ABRA\VERITABANIM;Initial Catalog = Sozluk; Integrated Security = True";
        string ingilizceSorgusu = "SELECT [KA].[Anlam] " +
                                  "FROM [KelimeAnlam] [KA] " +
                                  "LEFT OUTER JOIN [IngKelimeler] [IK] ON [KA].[KelimeID] = [IK].[ID] " +
                                  "WHERE [IK].[Kelime] LIKE '@deger%'";
        string turkceSorgusu = "SELECT [IK].[Kelime] " +
                                  "FROM [IngKelimeler] [IK] " +
                                  "LEFT OUTER JOIN [KelimeAnlam] [KA] ON [KA].[KelimeID] = [IK].[ID] " +
                                  "WHERE [KA].[Anlam] LIKE '@deger%'";

        #endregion

        #region Metotlar

        public Arama()
        {
            InitializeComponent();
            ingilizceSecim.Select();

            Baglanti = new SqlConnection(baglantiCumlesi);
            Duzenle();
        }

        private void Duzenle()
        {
            kelimeGiris.Select();
            kelimeGiris.SelectionStart = 0;
            sonucListe.Items.Clear();
        }

        private void Cikis_Click(object sender, EventArgs e)
        {
            this.Close();
        }

        #endregion

        #region Giriş alanı

        private void KayitIsle(object sender, EventArgs e)
        {
            string girdi;

            #region İngilizce seçim

            if (ingilizceSecim.Checked)
            {
                #region Sorgu alanı
                #region Girdi kontrol

                if (!kelimeGiris.Text.Equals(String.Empty))
                    girdi = kelimeGiris.Text.ToLower();
                else
                {
                    MessageBox.
                        Show("Lütfen İngilizce kelime alanını boş bırakmayınız.",
                        "Boş alan",
                        MessageBoxButtons.OK,
                        MessageBoxIcon.Error);

                    Duzenle();

                    return;
                }

                #endregion

                #region Bağlantı
                Baglanti.Open();

                #region Sorgu
                using (Sorgu = new SqlCommand(ingilizceSorgusu, Baglanti))
                {
                    Sorgu.Parameters.AddWithValue("@deger", girdi);
                    Sorgu.CommandType = CommandType.Text;

                    Okuyucu = Sorgu.ExecuteReader();

                    // Can't retrieve data into ListBox here
                    while (Okuyucu.Read())
                        sonucListe.Items.Add(Okuyucu["Anlam"].ToString());

                    Okuyucu.Close();
                }
                #endregion

                Baglanti.Close();
                #endregion
                #endregion

                return;
            }
            #endregion

            #region Türkçe seçim
            if (turkceSecim.Checked)
            {
                #region Sorgu alanı
                if (!kelimeGiris.Text.Equals(String.Empty))
                    girdi = kelimeGiris.Text.ToLower();
                else
                {
                    MessageBox.Show("Lütfen Türkçe kelime alanını boş bırakmayınız.",
                                    "Boş alan",
                                    MessageBoxButtons.OK,
                                    MessageBoxIcon.Error,
                                    MessageBoxDefaultButton.Button1,
                                    MessageBoxOptions.ServiceNotification);

                    Duzenle();

                    return;
                }

                #region Bağlantı
                using (Baglanti = new SqlConnection(baglantiCumlesi))
                {
                    Baglanti.Open();

                    #region Sorgu
                    using (Sorgu = new SqlCommand(turkceSorgusu, Baglanti))
                    {
                        Sorgu.Parameters.AddWithValue("@deger", girdi);

                        #region Sonuç aktarma

                        using (Okuyucu = Sorgu.ExecuteReader())
                        {
                        }
                        #endregion
                    }
                    #endregion

                    Baglanti.Close();
                }
                #endregion
                #endregion

                return;
            }
            #endregion
        }
        #endregion

        #region Dil tercih değişim
        private void ingilizceSecim_CheckedChanged(object sender, EventArgs e)
        {
            kelimeBaslik.Text = "İngilizce";
            anlamBaslik.Text = "Türkçe";
        }

        private void turkceSecim_CheckedChanged(object sender, EventArgs e)
        {
            kelimeBaslik.Text = "Türkçe";
            anlamBaslik.Text = "İngilizce";
        }
        #endregion
    }
}

Answer 1

This has nothing to do with ADO.NET. That query wouldn't return any results if it was executed in SSMS either. That's because LIKE '@deger%' searches for a string that starts with the characters @deger .

Query parameters are like function parameters - they aren't injected into the query string, they are passed to the compiled query as ... values. When a client executes a query with parameters, those are sent outside the query. That's why parameterized queries aren't vulnerable to SQL injection - the values are never part of the query. (Unless the developer goes out of his way to reintroduce that risk).

In SSMS or a stored procedure the correct query would look like this :

define @deger varchar(20)='whatever%'

SELECT [KA].[Anlam] 
FROM [KelimeAnlam] [KA]    
    LEFT OUTER JOIN [IngKelimeler] [IK] ON [KA].[KelimeID] = [IK].[ID]
WHERE [IK].[Kelime] LIKE @deger

or

define @deger varchar(20)='whatever'

SELECT [KA].[Anlam] 
FROM [KelimeAnlam] [KA]    
    LEFT OUTER JOIN [IngKelimeler] [IK] ON [KA].[KelimeID] = [IK].[ID]
WHERE [IK].[Kelime] LIKE @deger + '%'

The query string would have to use one of these forms too, eg:

var ingilizceSorgusu = "SELECT [KA].[Anlam] " +
                       "FROM [KelimeAnlam] [KA] " +
                       "LEFT OUTER JOIN [IngKelimeler] [IK] ON [KA].[KelimeID] = [IK].[ID] " +
                       "WHERE [IK].[Kelime] LIKE @deger + '%'";