查询在数据库中执行,但在WebService中执行时不执行

本文关键字:执行 WebService 但在 数据库 查询 | 更新日期: 2023-09-27 18:01:30

我的WebService有一些问题。当我在数据库中执行查询时,返回fine,但是当我通过服务(在线)执行时,返回错误System.Data.SqlClient.SqlException: Incorrect syntax near '<'.

    [WebMethod]
    public XmlDocument listagemCredenciadasCoordenadaGeografica(string latitude, string longitude, float raio)
    {
        try
        {
            string s = "SELECT San_Filial.Credenciada_Id " 
                + "FROM San_Filial " 
                + "WHERE (San_Filial.Excluido = 0) " 
                + "AND (San_Filial.Credenciada_Id NOT IN (62, 85, 1, 68, 10, 151, 152, 153, 154, 155)) " 
                + "AND San_Filial.lat != '0' " 
                + "AND San_Filial.lat IS NOT NULL "
                + "AND San_Filial.ddd IS NOT NULL " 
                + "AND ACOS( COS(RADIANS(RTRIM(LTRIM(San_Filial.lat)))) * " 
                + "COS(RADIANS(convert(float," + latitude + "))) * " 
                + "COS(RADIANS(RTRIM(LTRIM(San_Filial.lon))) - " 
                + "RADIANS(convert(float," + longitude + "))) + " 
                + "SIN(RADIANS(RTRIM(LTRIM(San_Filial.lat))) * " 
                + "SIN(RADIANS(convert(float," + latitude + ")))) * 6380 < " + raio + " ";
            XmlDocument xml = new XmlDocument();
            xml.LoadXml(ExecuteStrQuery(s, "Table").GetXml());
            return xml;
        }
        catch (Exception ex)
        {
            throw ex;
        }
    }

public static DataSet ExecuteStrQuery(string Query, string NameTable)
        {
            neticonn.ConexaoWebServices conn = new neticonn.ConexaoWebServices();
            SqlConnection c = new SqlConnection(conn.novaConexao("netservicemobile"));
            DataSet ds = new DataSet();
            SqlDataAdapter da = new SqlDataAdapter();
            try
            {
                SqlCommand cmd = new SqlCommand(Query, c);
                cmd.CommandType = CommandType.Text;
                da = new SqlDataAdapter(cmd);
                da.Fill(ds, NameTable);
                return ds;
            }
            catch (Exception ex)
            {
                throw new Exception(ex.Message, ex);
            }
            finally
            {
                try
                {
                    if (c.State != ConnectionState.Closed)
                    {
                        c.Close();
                        c.Dispose();
                        da.Dispose();
                    }
                }
                catch
                {
                }
            }
        }

查询在数据库中执行,但在WebService中执行时不执行

我想到了两个想法。

1)当执行sql查询时,请使用参数化查询…命名参数甚至更好。串联是坏的,坏的,坏的!如果你不熟悉,请阅读SQL注入。

2) &lt;<的html,所以我的猜测是你需要在使用查询

的值之前查看html编码/解码