我的Count Query asp.net有什么问题

Question

Public state_name as String
state_name = Textbox1.Text

Dim constr As String = ConfigurationManager.ConnectionStrings("ApplicationServices").ConnectionString
Dim query As String = "SELECT Count(cities) FROM state_table WHERE state_name=" & state_name
Using conn As New SqlConnection(constr)
    Using comm As New SqlCommand()
        conn.Open()
        With comm
            .Connection = conn
            .CommandText = query
            .CommandType = CommandType.Text
        End With

        Dim count As Int16 = Convert.ToInt16(comm.ExecuteScalar())
        Label1.Text = count
    End Using
End Using

代码显示错误

无效的列名“加利福尼亚”。

但是， California已经存在于我的State列表中，我想计算所有在State表中输入的state_name= california下的城市。

我希望输出为

California (3)

Answer 1

您想使用参数化查询来避免SQL注入。

Dim constr As String = ConfigurationManager.ConnectionStrings("ApplicationServices").ConnectionString
Dim query As String = "SELECT Count(cities) FROM state_table WHERE state_name=@State_Name"
Using conn As New SqlConnection(constr)
   Using comm As New SqlCommand()
      conn.Open()
      With comm
         .Connection = conn
         .CommandText = query
         .CommandType = CommandType.Text
         .Parameters.AddWithValue("@State_Name", state_name)
      End With
      Dim count As Int16 = Convert.ToInt16(comm.ExecuteScalar())
      Label1.Text = count
   End Using
End Using

Answer 2

因为您没有用引号将变量引起来。 "state_name = '" + state_name + "'"

但是，您应该改用参数。