16,722
社区成员




Button1为查询按钮,我用以下代码为了实现多条件查询,并将查询结果显示在datagridview中,提示 “Parameters不是string成员” ,请教该怎么解决?谢谢!!!
Imports System.Data.SqlClient
Public Sub FilterAndDisplayData(ByVal connectionString As String, ByVal query As String)
Using connection As New SqlConnection(connectionString)
Dim adapter As New SqlDataAdapter(query, connection)
Dim table As New DataTable()
connection.Open()
adapter.Fill(table)
connection.Close()
DataGridView1.DataSource = table
End Using
End Sub
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
Dim connectionString As String = "Data Source=XTZJ-20230713LX\COSBYVAL;Initial Catalog=SJBG;Integrated Security=True"
Dim Value_AA, Value_AB, Value_B, Value_C, Value_D, Value_E, Value_F As String
If Me.ComboBox1.Text <> "" Then
Value_AA = Me.ComboBox1.Text
Else
Value_AA = "*"
End If
If Me.ComboBox3.Text <> "" Then
Value_AB = Me.ComboBox3.Text
Else
Value_AB = "*"
End If
If Me.TextBox1.Text <> "" Then
Value_B = Me.TextBox1.Text
Else
Value_B = "*"
End If
If Me.ComboBox16.Text <> "" Then
Value_C = Me.ComboBox16.Text
Else
Value_C = "*"
End If
If Me.ComboBox4.Text <> "" Then
Value_D = Me.ComboBox4.Text
Else
Value_D = "*"
End If
If Me.ComboBox8.Text <> "" Then
Value_E = Me.ComboBox8.Text
Else
Value_E = "*"
End If
If Me.TextBox20.Text <> "" Then
Value_F = Me.TextBox20.Text
Else
Value_F = "*"
End If
Dim query As String = "SELECT * FROM KJS" & Strings.Left(Me.ComboBox2.Text, 4) & " WHERE zsaxm = @value1 AND zsbxm = @value2 AND bsdwmc = @value2 AND ywlx = @value2 AND zs = @value2 AND bgwh = @value2 AND bz = @value2"
Dim parameters As SqlParameter() = {
New SqlParameter("@value1", SqlDbType.VarChar, 100) With {.Value = Value_AA},
New SqlParameter("@value2", SqlDbType.VarChar, 100) With {.Value = Value_AB},
New SqlParameter("@value3", SqlDbType.VarChar, 100) With {.Value = Value_B},
New SqlParameter("@value4", SqlDbType.VarChar, 100) With {.Value = Value_C},
New SqlParameter("@value5", SqlDbType.VarChar, 100) With {.Value = Value_D},
New SqlParameter("@value6", SqlDbType.VarChar, 100) With {.Value = Value_E},
New SqlParameter("@value7", SqlDbType.VarChar, 100) With {.Value = Value_F}
}
For Each parameter In parameters
Command.Parameters.Add(parameter)
Next
FilterAndDisplayData(connectionString, query)
End Sub
直接把查询条件拼接到query字符串里不好吗?为啥非得用参数的方法。是为了防止SQL注入?
估计是什么地方的类型转换出了问题了,这是某个地方把 Parameters 当作 String 这个对象的一个属性用了,如果能知道是执行到那条语句出错就可以溯源了