准則表達中的數據類型不匹配錯誤（ms Access）

Question

請找出我的代碼中的錯誤。

准則表達中的數據類型錯誤。

OleDbCommand cmd = new OleDbCommand("DELETE tbbill.*, tbgrid.* FROM tbbill INNER JOIN tbgrid ON tbbill.invoice = tbgrid.ginovice WHERE tbbill.invoice ='" + Convert.ToInt32(txtinvoice.Text) + "'", con);
cmd.ExecuteNonQuery();
cmd.Dispose();

Answer 1

它一定要是

OleDbCommand cmd = new OleDbCommand(
                "DELETE tbbill.*, tbgrid.* 
                 FROM tbbill 
                 INNER JOIN tbgrid 
                    ON tbbill.invoice = tbgrid.ginovice 
                 WHERE tbbill.invoice = " + Convert.ToInt32(txtinvoice.Text) , con);

我已從發票中刪除''

而您應該始終使用參數化的SQL來防止SQL注入

OleDbCommand cmd = new OleDbCommand(
                "DELETE tbbill.*, tbgrid.* 
                 FROM tbbill 
                 INNER JOIN tbgrid 
                    ON tbbill.invoice = tbgrid.ginovice 
                 WHERE tbbill.invoice = @invoice", con);

cmd.Parameters.Add("@invoice", Convert.ToInt32(txtinvoice.Text) );  
cmd.ExecuteNonQuery();

Answer 2

單引號用於字符，如果您的invoice是數字類型的，則需要刪除這些引號，例如；

tbbill.invoice = " + Convert.ToInt32(txtinvoice.Text) + ...

但是請不要使用這種方式。

始終使用參數化查詢 。 這類字符串連接對SQL注入攻擊開放。

並使用using語句自動處理您的命令和連接，而不是手動調用Dispose方法。

using(OleDbConnection con = new OleDbConnection(conString))
using(OleDbCommand cmd = con.CreateCommand())
{
    cmd.CommandText = "DELETE tbbill.*, tbgrid.* FROM tbbill INNER JOIN tbgrid ON tbbill.invoice = tbgrid.ginovice WHERE tbbill.invoice = @invoice";
    cmd.Parameters.Add("@invoice", OleDbType.Integer).Value = Convert.ToInt32(txtinvoice.Text);
    // I used OleDbType.Integer in my example. You should use proper OleDbType for your column.
    con.Open();
    cmd.ExecuteNonQuery();
}