2011-07-22 32 views
0

我正在使用ASP.NET Razor。CSHTML - SQL QUERY .... WHERE NAME = @ NameOne

<form style="display:inline" name="formular1" method="post" action="default.cshtml"> 
          <select name="phone1" class="dropdown"> 
          @foreach(var row in db.Query("SELECT * FROM Handy")){ 
       <option value="@row.Handyname">@row.Handyname</option> 
      } 
             </select> 
     vs. 
          <select name="phone2" class="dropdown"> 
              @foreach(var row in db.Query("SELECT * FROM Handy")){ 
       <option value="@row.Handyname">@row.Handyname</option> 
      } 
             </select> 
     <input type="submit"/ value="Compare"> 
     </form> 
     @{ 
      var phoneOne = ""; 
      var phoneTwo = ""; 
        if(IsPost){ 

         // request input of the select forms 
         phoneOne = Request["phone1"]; 
         phoneTwo = Request["phone2"]; 
        } 
       }          
    </div> 

    <div class="content"> 
     <div class="start"> 
      <p><h2>@phoneOne</h2></p> 
      <ul> 
      @{ 
       if(IsPost){ 
        foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")){ 
       <li>processor: @row.Prozessor GHz</li> 
       <li>memory: @row.RAM MB Ram</li> 
       <li>weight: @row.Gewicht g</li> 
       <li>display: @row.Display ''</li> 
       <li>OS: @row.OS</li> 
      } 
       } 
      } 


      </ul> 
     </div> 

获取查询错误:WHERE Handyname = @ phoneOne ...把​​它们全部正常工作。我究竟做错了什么?

谢谢:)!

+0

什么是错误? SQL错误还是Razor? – GalacticCowboy

回答

1

还不是很确定,但我认为你需要更换此:

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")) 

有了这个:

foreach(var row in db.Query("SELECT * FROM Handy WHERE Handyname= " + phoneOne)) 
+1

如果你采用这种方式,你需要非常小心地防止[SQL注入攻击](http://en.wikipedia.org/wiki/SQL_injection)。 –

1

如上所述here,请尝试以下操作:

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]@phoneOne")){ 
0

是db Razor中对数据库组件的引用?如果是这样,它使用@ 0,@ 1,(索引)而不是命名参数。

foreach(var row in db.Query("SELECT * FROM Handy WHERE [email protected]")) 

并通过该方法中的参数集合传递值。