'；附近的语法不正确；00'

本文关键字：不正确 语法 | 更新日期: 2023-09-27 18:05:04

我是asp&sql服务器。我在sql查询中遇到问题。

string obal ;
        decimal _obalss = 0;
        decimal obalss = 0;
        sconnection c = new sconnection();
        string cus_id = Session["cusid"].ToString();
        DateTime maxdate = DateTime.Parse(fromdt.Text, new System.Globalization.CultureInfo("en-US"));
        string mdate = maxdate.ToString();
        string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 
        SqlDataReader dr = c.reader(query_sl);
        if (dr.Read())
        {
            decimal.TryParse(dr["amount"].ToString(), out _obalss);
            obalss = _obalss;
        }
        else
        {
            obalss = 0;
        }
            dr.Close();
            dr.Dispose();

'；附近的语法不正确；00'

 string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid";

maxdate是一个日期，你必须把它放在单引号里。更好的是，应该使用参数化SQL查询，否则很容易受到SQL注入攻击。像这样的东西怎么样：

string query_sl = "select sum(amount) as amount from sale where cusid = @CUSID and invdate < @MAXDATE group by cusid"; 
using(SqlCommand cmd = new SqlCommand(query_sl, c))
{
    cmd.Parameters.Add(new SqlParameter("@CUSID", SqlDbType.Int)).Value = cus_id;
    cmd.Parameters.Add(new SqlParameter("@MAXDATE", SqlDbType.DateTime)).Value = maxdate;
    ...
}

string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < '" + maxdate + "' group by cusid";

注意maxdate周围的单引号。。。

相关文章：