这么写带参数的语句错了？？

[redsunsry]

StringBuilder sql = new StringBuilder();
sql.Append("select * from(select top @ccts");
sql.Append(" * from(select top @endRecord");
sql.Append(" * from Info where gsid = @gsid");
sql.Append(" order by dateandtime desc)");
sql.Append("t1 order by dateandtime)");
sql.Append("t2 order by dateandtime desc");

SqlDataAdapter sda = new SqlDataAdapter();
sda.SelectCommand = new SqlCommand(sql.ToString(), con);
SqlParameter pccts = new SqlParameter("@ccts", SqlDbType.Int);
pccts.Value = ccts;
SqlParameter pendRecord = new SqlParameter("@endRecord", SqlDbType.Int);
pendRecord.Value = endRecord;
SqlParameter pgsid = new SqlParameter("@gsid", SqlDbType.Int);
pgsid.Value = gsid;
sda.SelectCommand.Parameters.Add(pccts);
sda.SelectCommand.Parameters.Add(pendRecord);
sda.SelectCommand.Parameters.Add(pgsid);

[superliu1122]

top后面的数值不能用参数

[redsunsry]

我那个值是接受用户输入的 那怎么做才能防止注入？ 如何转为数值类型？

[superliu1122]

在构造sql语句的时候直接加进去
sql.Append("select * from(select top ");
sql.Append(ccts);
sql.Append(" * from(select top ");
sql.Append(endRecord);
sql.Append(" * from Info where gsid = @gsid");
sql.Append(" order by dateandtime desc)");
sql.Append("t1 order by dateandtime)");
sql.Append("t2 order by dateandtime desc");

[superliu1122]

用int.Parse()方法把输入转换成整型