SQLDataReader无法读取

Question

我正在尝试创建一个警报系统，以检查与药物有关的过敏症与与患者有关的过敏症（请参见下图）。

当我运行代码时，似乎只是完全跳过了SQLDataReader，我对if（reader.HasRows）进行了检查，它仅显示读取器中没有行。 我要做的就是在阅读器的最后显示一个带有所选过敏名称的消息框。 我使用的是SQL Server 2014.任何帮助将不胜感激。

private void button_addItem_Click(object sender, RoutedEventArgs e)
{
    if (!string.IsNullOrEmpty(comboBox_select_Item.Text.ToString()))
    {
        using (SqlConnection conn = new SqlConnection(connection))
        {
            try
            {
                SqlCommand sqlCmd2 = new SqlCommand("SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE A.allergyID = PA.allergyID AND PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = " + comboBox_select_Item.SelectedValue.ToString() + ")", conn);
                conn.Open();
                SqlDataReader sqlReader = sqlCmd2.ExecuteReader();
                Allergies allergies = new Allergies();

                while (sqlReader.Read())
                {
                    allergies.allergyName = Convert.ToString(sqlReader["allergyName"]);
                    allergies.allergyDescription = Convert.ToString(sqlReader["allergyDescription"]);
                }

                MessageBox.Show(allergies.allergyName);
                sqlReader.Close();
                FillSalesItemGrid();
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.ToString(), ex.ToString());
            }
        }
    }
}

Answer 1

首先，您的SqlCommand容易受到sql注入攻击-您应该始终使用SqlParameter，因为它有助于防止sql注入。 因此，您的SqlCommand应该看起来像：

SqlCommand sqlCmd2 = new SqlCommand("SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE A.allergyID = PA.allergyID AND PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = @medID)", conn);

您可以传递参数：

  sqlCmd2.Parameters.AddWithValue("@medID",comboBox_select_Item.SelectedValue);

而且，查询中的以下语句是多余的

WHERE A.allergyID = PA.allergyID 

因为您在此字段上有INNER JOIN

FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID 

因此您可以从查询中删除多余的语句

SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = @medID)

我很确定您其余的代码或多或少都可以。 请查看您的查询是否返回任何行。 例如，您可以复制查询并将@medID替换为comboBox中的值。