System.Data.SqlClient.SqlException：关键字'FROM'附近的语法不正确

我试图在ASP.net中创建一个网站，它向我展示了我们组织推出的出版物。以下是来自cs文件的一些代码。System.Data.SqlClient.SqlException：关键字'FROM'附近的语法不正确

//2nd - Setup SQL Command 
    SqlCommand cmd = new SqlCommand("SELECT [IDTip], [Date], CONVERT(nvarchar(100),[Date], 1) AS Released, [Title], [Image], REPLACE(CONVERT (nvarchar(MAX),[Tip]), '</p>\r\n\r\n<p>', '<p></p>') AS ContentConverted, Recognition, FROM tips WHERE IDTip =" + Request.QueryString["IDTip"], new SqlConnection(HealthReachConString)); 

//3rd - Attempt to open the connection to the DB 
    cmd.Connection.Open(); 

//4th - Go and fetch some data and apply it to our controls 
    SqlDataReader objReader = cmd.ExecuteReader(); 
    while (objReader.Read()) 
    { 
     lblDate.Text = objReader.GetString(2); 
     lblTitle.Text = objReader.GetString(4); 
     lblTip.Text = Convert.ToString(objReader["ContentConverted"]); 
     imgContentPicture.ImageUrl = "~/files/Health_Tips/" + objReader.GetString(5); 
     if (objReader.GetString(5) == " " || objReader.GetString(5) == "") 
     { 
      imgContentPicture.Visible = false; 
     } 
     else 
     { 
      imgContentPicture.Visible = true; 
     } 

    } 
    objReader.Close(); 
    cmd.Connection.Close();

这是我得到的错误。

Server Error in '/' Application.
Incorrect syntax near the keyword 'FROM'.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near the keyword 'FROM'.

Source Error:

Line 23:
Line 24: //4th - Go and fetch some data and apply it to our controls Line 25: SqlDataReader objReader = cmd.ExecuteReader();
Line 26: while (objReader.Read())
Line 27: {

Stack Trace:

[SqlException (0x80131904): Incorrect syntax near the keyword 'FROM'.]
System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +1791910
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +5347106 System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObjec>t stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +546
System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +1693
System.Data.SqlClient.SqlDataReader.TryConsumeMetaData() +61
System.Data.SqlClient.SqlDataReader.get_MetaData() +90
System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString) +377
System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async, Int32 timeout, Task& task, Boolean asyncWrite, SqlDataReader ds) +1421
System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, TaskCompletionSource`1 completion, Int32 timeout, Task& task, Boolean asyncWrite) +177
System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method) +53 System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) +137
System.Data.SqlClient.SqlCommand.ExecuteReader() +99
PressRoom_Detail.Page_Load(Object sender, EventArgs e) in E:\web\healthreach\htdocs\Tips_Detail.aspx.cs:25
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +51
System.Web.UI.Control.OnLoad(EventArgs e) +92
System.Web.UI.Control.LoadRecursive() +54
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +772

任何想法是怎么回事？

来源

2015-07-20 Patrick Simpson

[SQL注入警报]（http://msdn.microsoft.com/en-us/library/ms161953%28v=sql.105%29.aspx） - 您应该**不**将您的SQL语句连接在一起 - 使用**参数化查询**来代替以避免SQL注入 –

为了澄清您的问题，多余的逗号指示SQL另一个参数存在，但您的参数是你FROM。在FROM之前删除逗号后，您的语法应该是有效的。假设您已经为您的CONVERT和Alias函数指示了适当的语法。

我也想指出你的查询很容易发生SQL注入。要解决你应该这样做的部分：

SELECT [IDTip], [Date], 
CONVERT(nvarchar(100),[Date], 1) AS Released, [Title], [Image], 
REPLACE(CONVERT (nvarchar(MAX),[Tip]), '</p>\r\n\r\n<p>', '<p></p>') AS [ContentConverted], [Recognition] 
FROM [Tips] 
WHERE ([IDTip] = @Id);

这就是我在我的评论查询中看到的故障。

来源

2015-07-20 18:39:17 Greg

感谢您的帮助！看起来像是工作。 –

额外的垃圾：

SELECT ... Recognition, FROM ... 
         ^---

来源

2015-07-20 18:31:11

System.Data.SqlClient.SqlException：关键字'FROM'附近的语法不正确

回答

相关问题