根据C＃中datagridview中组合框的值从SQL Server检索数据

Question

我试图根据datagridview中组合框的值从SQL DB的列中检索数据，我的代码是：

 private void dataGridView1_CellEndEdit(object sender, DataGridViewCellEventArgs 
 {
        using (SqlConnection conn = new SqlConnection("Data Source=POSSERVER\\SQLEXPRESS;Initial Catalog=ms;Integrated Security=True"))
        {
            string priceselected = ("SELECT price FROM Table_1 WHERE name=" + dataGridView1.CurrentRow.Cells[0].Value.ToString());
            SqlCommand cmd = new SqlCommand(priceselected, conn);
            conn.Open();
            cmd.ExecuteNonQuery();
            conn.Close();
        }
 } 

我想把价格放在dataGridView1.CurrentRow.Cells[2]

但是每次我从组合框中选择项目时，我都会得到一个sqlexception

有帮助吗??

Answer 1

如果“ Name ”列的数据类型为VARCHAR，则需要使用单引号将值引起来，因为它是字符串文字。

string _val = dataGridView1.CurrentRow.Cells[0].Value.ToString();
string priceselected = ("SELECT price FROM Table_1 WHERE name='" + _val + "'");

但是查询容易受到SQL Injection攻击。 请对查询进行参数化，例如。

string _val = dataGridView1.CurrentRow.Cells[0].Value.ToString();
string priceselected = ("SELECT price FROM Table_1 WHERE name=@val");
SqlCommand cmd = new SqlCommand(priceselected, conn);
cmd.Parameters.AddWithValue("@val", _val);
conn.Open();
cmd.ExecuteNonQuery();