asp 多条件查询 SQL 查询的时候应该怎么办！

[恶魔的幻影]

asp 多条件查询 SQL 查询的时候应该怎么办！

比如当选着“全部”的时候 sql 中的查询语句 a.GongSiNo = '"&request("gongsi")&"' 不应该有！

现在的语句是这样的！

select a.gongsimc,a.card_kehu_no as kehu_no,a.card_no,a.card_kehu_mc as kehu_mc,a.card_kehu_shouji as kehu_dh,a.che_no,a.card_kind,a.card_enddate,lastdate,datediff(day,isnull(lastdate,getdate()-365),getdate()) days from (select zhifu_card_no,max(lastdate) as lastdate  from (select zhifu_card_no ,xche_jsrq  lastdate from work_pz_sj union select zhifu_card_no,xc_rq lastdate from work_xiche_pz_sj union select zhifu_card_no,xiao_rq lastdate from xiaosh_pz_sj union select card_no as zhifu_card_no,xche_jsrq  lastdate from work_pz_sj union select card_no as zhifu_card_no,xc_rq lastdate from work_xiche_pz_sj union select card_no as zhifu_card_no,xiao_rq lastdate from xiaosh_pz_sj) aa  group by zhifu_card_no) b left join card a  on b.zhifu_card_no=a.card_no  where a.card_no is not null and lastdate>='"&request("txtBeginDate")&"' and lastdate<='"&request("txtEndDate")&"' and a.GongSiNo = '"&request("gongsi")&"' and datediff(day,isnull(lastdate,getdate()-365),getdate())>='"&request("txtDay")&"' and datediff(day,isnull(lastdate,getdate()-365),getdate())<='"&request("txtDay2")&"' ORDER BY lastdate

[Go 旅城通票]

sql="select a.gongsimc,a.card_kehu_no as kehu_no,a.card_no,a.card_kehu_mc as kehu_mc,a.card_kehu_shouji as kehu_dh,a.che_no,a.card_kind,a.card_enddate,lastdate,datediff(day,isnull(lastdate,getdate()-365),getdate()) days from (select zhifu_card_no,max(lastdate) as lastdate  from (select zhifu_card_no ,xche_jsrq  lastdate from work_pz_sj union select zhifu_card_no,xc_rq lastdate from work_xiche_pz_sj union select zhifu_card_no,xiao_rq lastdate from xiaosh_pz_sj union select card_no as zhifu_card_no,xche_jsrq  lastdate from work_pz_sj union select card_no as zhifu_card_no,xc_rq lastdate from work_xiche_pz_sj union select card_no as zhifu_card_no,xiao_rq lastdate from xiaosh_pz_sj) aa  group by zhifu_card_no) b left join card a  on b.zhifu_card_no=a.card_no  where a.card_no is not null and lastdate>='"&request("txtBeginDate")&"' and lastdate<='"&request("txtEndDate")&"' and datediff(day,isnull(lastdate,getdate()-365),getdate())>='"&request("txtDay")&"' and datediff(day,isnull(lastdate,getdate()-365),getdate())<='"&request("txtDay2")&"'"


v=request("gongsi")
if v<>"全部" then sql=sql&" and a.GongSiNo = '"&v&"' 

sql=sql&" ORDER BY lastdate"

组合下就好了，还有其他数据要注释验证是否有值，还有有效性，你这个sql注入100%的

[KeepSayingNo]

你这个肯定用动态SQL，拼接SQL字符串，然后再执行该SQL