'=' 附近有语法错误

[KayGuoWhu]

private void treeView1_AfterSelect(object sender, TreeViewEventArgs e)
{
string depart_fullname = treeView1.SelectedNode.Name;
string sqlStr = "select depart_id from department where depart_fullname= " + depart_fullname + "";
string depart_id;
SqlCommand cmd = new SqlCommand(sqlStr, SQLManager.connection);
SqlDataReader reader = cmd.ExecuteReader();
if (reader.Read())
{
depart_id = reader[0].ToString();
}
}
想通过选择treeview的子结点获取数据库中的depart_id信息，from_load里已经连接数据库。
不清楚为什么总是提醒“ SqlDataReader reader = cmd.ExecuteReader();附近有语法错误”！还请各位指正！

[宝_爸]

sql中字符串用单引号
string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";

[熙风]

  string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";

单引号掉了

[q107770540]

你的代码问题多多啊
除了1楼给你指出的SQL语法错误外

你是直接拼接的SQL语句
这样很容易被SQL注入哦

[全栈极简]

参数化SQL

[海优]

[Quote=引用 1 楼 的回复:]

sql中字符串用单引号
string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";
[/Quote]


我也吃过单引号的亏~~这个地方应该有单引号~~

[yuz492813835]

[Quote=引用 1 楼 的回复:]

sql中字符串用单引号
string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";
[/Quote]
先在数据库里试一下可不可以用

[Johnny_Bao]

[Quote=引用 2 楼 的回复:]
SQL code

string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";


单引号掉了
[/Quote]确实，以前我也犯错

[son409]

拼字符串的方法容易被SQL注入

[lsjh21]

前后需要加单引号
'" + depart_fullname + "'"
同时，这种写法容易注入式错误
最好使用传参的方式进行

[sdbtongtong]

string sqlStr = "select depart_id from department where depart_fullname= '" + depart_fullname + "'";

参数是string类型的要打单引号，分给我嘛，我一分都没了

[asuka986]

改成参数化查询吧

[csdn_风中雪狼]

单引号，不在了，
拼接的sql