System.InvalidOperationException：ExecuteReader：CommandText属性尚未初始化错误即将发生

Question

当我没有为用户中的Usertype定义Usertype时，我的Gridview工作正常。 现在我的BindGrid()函数不能正常工作并给我错误

System.InvalidOperationException：ExecuteReader：CommandText属性尚未初始化错误即将发生

这是我的BindGrid代码： -

protected void BindGrid()
    {
        string username = string.Empty;
        string usertype = string.Empty;

        try
        {
            SqlConnection conn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["DefaultCSRConnection"].ConnectionString);
            SqlCommand cmd = new SqlCommand("SELECT usertype,username FROM tbl_User WHERE username='" + Session["User"].ToString() + "'", conn);
            conn.Open();
            SqlDataReader dr = cmd.ExecuteReader();
            if (dr.HasRows)
            {
                while (dr.Read())
                {
                    username = dr["username"].ToString();
                    usertype = dr["usertype"].ToString();
                }
            }
            conn.Close();

            string query = string.Empty;

            if (usertype == "0") // superadmin
            {
                query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User ORDER By Id DESC";
            }
            if (usertype == "1") // admin
            {
                query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User WHERE usertype != '0' ORDER By Id DESC";
            }
            if (usertype == "2") // user
            {
                query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User WHERE username='" + username + "' ORDER By Id DESC";
            }

            cmd = new SqlCommand(query, conn);

            SqlDataAdapter da = new SqlDataAdapter(cmd);

            DataSet ds = new DataSet();
            da.Fill(ds);
            grdUser.DataSource = ds.Tables[0];
            grdUser.DataBind();
        }
        catch (Exception)
        {
            throw;
        }
    }

请在这里建议有什么问题。

Answer 1

我推荐以下内容：

• using语句实现代码
• 使用参数化SQL
• 确保您的初始查询返回一条记录并且只返回一条记录（您的循环将仅捕获上次遇到的username和usertype ）
• 实现switch语句并确保正确处理default情况
• 确保您的第二个SQL查询的连接已打开
• 如果您只是重新抛出异常，则不需要try / catch块。

Answer 2

我现在已经添加了参数及其安全使用。

protected void BindGrid()
        {
            string username = string.Empty;
            string usertype = string.Empty;

            try
            {
                SqlConnection conn = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["DefaultCSRConnection"].ConnectionString);
                SqlCommand cmd = new SqlCommand("SELECT usertype,username FROM tbl_User WHERE username=@username", conn);
                cmd.Parameters.Add("@username", SqlDbType.VarChar).Value = Session["User"].ToString();

                conn.Open();
                SqlDataReader dr = cmd.ExecuteReader();
                if (dr.HasRows)
                {
                    if (dr.Read())
                    {
                        username = dr["username"].ToString();
                        usertype = dr["usertype"].ToString();
                    }
                }
                conn.Close();

                string query = string.Empty;

                if (!string.IsNullOrEmpty(usertype))
                {
                    if (usertype == "0") // superadmin
                    {
                        query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User ORDER By Id DESC";
                    }
                    if (usertype == "1") // admin
                    {
                        query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User WHERE usertype != '0' ORDER By Id DESC";
                    }
                    if (usertype == "2") // user
                    {
                        query = "select Id,username,email,usertype,active,(CASE WHEN usertype='1' THEN 'Admin' WHEN usertype='0' THEN 'Super Admin' WHEN usertype='2' THEN 'User' END) AS UserRoleName from tbl_User WHERE username='" + username + "' ORDER By Id DESC";
                    }

                    cmd = new SqlCommand(query, conn);

                    SqlDataAdapter da = new SqlDataAdapter(cmd);

                    DataSet ds = new DataSet();
                    da.Fill(ds);
                    grdUser.DataSource = ds.Tables[0];
                    grdUser.DataBind();
                }
            }
            catch (Exception)
            {
                throw;
            }
        }