oledbException未處理的錯誤映射

Question

我正在嘗試使用以下代碼填充具有姓氏和姓氏的文本框：

using (OleDbConnection connName = new OleDbConnection(strCon))
            {

                String sqlName = "SELECT forename, Surname FROM customer WHERE [customerID]=" + txtCustomerID.Text;

                // Create a command to use to call the database.
                OleDbCommand commandname = new OleDbCommand(sqlName, connName);
                 connName.Open();
                // Create a reader containing the results


                using (OleDbDataReader readerName = commandname.ExecuteReader())
                {
                    readerName.Read(); // Advance to the first row.
                    txtName.Text = readerName[0].ToString();
                }
                connName.Close();                 

             }

但是我遇到了錯誤： OleDbException未處理。

“多個必需參數之一沒有必需值”

在ExecuteReader ，我不確定如何解決此問題。

編輯：下面的代碼幾乎與查詢中的信息完全相同，但此異常不會出現。

  string strCon = Properties.Settings.Default.PID2dbConnectionString;

        using (OleDbConnection conn = new OleDbConnection(strCon))
        {
            String sqlPoints = "SELECT points FROM customer WHERE [customerID]=" + txtCustomerID.Text;
            conn.Open();

            // Create a command to use to call the database.
            OleDbCommand command = new OleDbCommand(sqlPoints, conn);
            // Create a reader containing the results

            using (OleDbDataReader reader = command.ExecuteReader())
            {
                reader.Read(); // Advance to the first row.
                txtPoints.Text = reader[0].ToString(); // Read the contents of the first column
            }
            conn.Close();
        }

Answer 1

通常的原因是字符串為空或空，即txtCustomerID.Text沒有值，因此發送到服務器的查詢為：

SELECT forename, Surname FROM customer WHERE [customerID]= 

您可以避免此類錯誤和SQL Injection ，可以使用強類型參數，並可以避免使用參數化查詢進行數據截斷（我假設客戶ID是一個i​​nt字段）

    using (OleDbConnection connName = new OleDbConnection(strCon))
    {
        String sqlName = "SELECT forename, Surname FROM customer WHERE customerID = @CustomerID";

        // Create a command to use to call the database.
        using (OleDbCommand commandname = new OleDbCommand(sqlName, connName))
        {

            //Check the input is valid
            int customerID = 0;
            if (!int.TryParse(txtCustomerID.Text, out customerID))
            {
                txtName.Text = "Customer ID Text box is not an integer";
                return;
            }


            connName.Open();

            // Add the parameter to the command
            commandname.Parameters.Add("@CustomerID", OleDbType.Integer).Value = customerID;

            // Create a reader containing the results
            using (OleDbDataReader readerName = commandname.ExecuteReader())
            {
                readerName.Read(); // Advance to the first row.
                txtName.Text = readerName[0].ToString();
            }
            connName.Close();                 
        }
    }

Answer 2

您必須對字符串查詢中使用的參數進行編碼。

  String sqlName = String.Format("SELECT forname, Surname FROM customer WHERE customerID={0}",txtCustomerID.Text);

但是我建議您不要使用以字符串硬編碼的SQL查詢。 SQL注入攻擊的簡單方法。 您應該改為使用參數。