带参数的DataAdapter SQL查询-C＃

Question

下面的代码运行正常，并且可以通过按列搜索来查看所有匹配项。

string sql = "SELECT car, model, year FROM store WHERE" + column + "LIKE " + search + "'"; 

现在在查询中添加参数。 不工作 它不会在列中显示搜索 。 如果列的搜索列（1 = 1），则仅显示列中的所有行

    public int SearchCar(MainStore searchCars)
    {
            string connection = @"Data Source=(LocalDB)";
            SqlConnection con = new SqlConnection(connection);
            string sql = "SELECT car, model, year FROM store WHERE @column like @search '";
            SqlDataAdapter sda = new SqlDataAdapter(sql, con);

            sdt.SelectCommand.Parameters.AddWithValue("@column", "%" + searchCars.GetCombo());
            sdt.SelectCommand.Parameters.AddWithValue("@search", "%" + searchCars.GetSearch());

            DataTable dt = new DataTable();
            sda.Fill(dt);
            dataGridView1.DataSource = data;
     }

在特定列中进行搜索的答案可能是什么？

Answer 1

请看看这个

 private static void Select() {

       string cmdStr = "SELECT FirstName, LastName, Telephone FROM Person WHERE FirstName = @FirstName";

        using (SqlConnection connection = new SqlConnection(ConnectionString))

        using (SqlCommand command = new SqlCommand(cmdStr, connection)) {

            command.Parameters.AddWithValue("@FirstName", "John");

            connection.Open();

            SqlDataReader reader = command.ExecuteReader();

            while (reader.Read()) {

                string output = "First Name: {0} \t Last Name: {1} \t Phone: {2}";

                Console.WriteLine(output, reader["FirstName"], reader["LastName"], reader["Telephone"]);

            }

        }

    }

Answer 2

如下进行更改，以免参数化列名：

public int SearchCar(MainStore searchCars)
    {
            string connection = @"Data Source=(LocalDB)";
            SqlConnection con = new SqlConnection(connection);
            string sql = string.Format("SELECT car, model, year FROM store WHERE {0} like @search", search.GetCombo());
            SqlDataAdapter sda = new SqlDataAdapter(sql, con);

           // sdt.SelectCommand.Parameters.AddWithValue("@column", "%" + search.GetCombo());
            sdt.SelectCommand.Parameters.AddWithValue("@search", "%" + search.GetSearch());

            DataTable dt = new DataTable();
            sda.Fill(dt);
            dataGridView1.DataSource = data;
     }

另外，查询末尾还有一个额外的引号： like @search '";