MSSQL XQuery的语法错误或根本没有结果

Question

I used this white paper from MS for reference: http://msdn.microsoft.com/en-us/library/ms345117(v=sql.90).aspx

However I get an error when I attempt the following query:

    command = new SqlCommand(
    "SET QUOTED_IDENTIFIER ON SELECT XML FROM XMLObject WHERE" + 
    "XML.exist('//Root/ActiveRecord[" + s1 + 
    "= " + s2 + "]') = 1"
    , connection);

The error is: "Syntax error near ".".

I am able to execute the command if I remove everything after "XMLObject" until the comma, and something IS returned if elements exist in the DB.

I am also curious as to whether I am setting the QUOTED_IDENTIFIER value the correct way.

Any example projects/tutorials in C#/MSSQL I might look at would be appreciated as well!

EDIT: For anyone seeing this, I have also found that the correct way of using exist is:

    "...exist('/Root/ActiveRecord[" + s1 + 
    "= \"" + s2 + "\"]') = 1"

Without the "s only numerical comparisons work.

Answer 1

You should avoid building SQL by concatenating strings at it is SQL injection vulnerable. You need a semi-colon after ON. Your columns datatype must be xml or you must convert it to xml.

Answer 2

I think you are missing a space between WHERE and XML :

command = new SqlCommand(
    "SET QUOTED_IDENTIFIER ON SELECT XML FROM XMLObject WHERE " + // Note space
    "XML.exist('//Root/ActiveRecord[" + s1 + 
    "= " + s2 + "]') = 1"
    , connection);