我需要使用C#筛选SQL数据库以将其显示在windowsFormsHost中。如何搜索SQL数据库并在C#中显示listview
为此,我创建了一个文本框,在其中输入所需的字符串。使用此输入,代码使用文本搜索数据库,并在单击刷新按钮时显示。
刷新按钮的工作和完成,我只需要根据我的过滤器创建与选定的行的列表。
下面是代码,其中指出,没有返回值:
private string GetPassengerList(string sPasssenger)
{
string sPasssengerL = textBoxPassengerName.Text;
if (sPasssenger.Trim().Length > 0)
{
string sToTime = dtpToDate.Value.Year.ToString("D4") + @"/" + dtpToDate.Value.Month.ToString("D2") + @"/" + dtpToDate.Value.Day.ToString("D2");
sToTime += @" " + dtpToTime.Value.Hour.ToString("D2") + @":" + dtpToTime.Value.Minute.ToString("D2") + @":" + dtpToTime.Value.Second.ToString("D2");
string sFromTime = dtpFromDate.Value.Year.ToString("D4") + @"/" + dtpFromDate.Value.Month.ToString("D2") + @"/" + dtpFromDate.Value.Day.ToString("D2");
sFromTime += @" " + dtpFromTime.Value.Hour.ToString("D2") + @":" + dtpFromTime.Value.Minute.ToString("D2") + @":" + dtpFromTime.Value.Second.ToString("D2");
string sSqlSelect = @"SELECT Passenger FROM ";
string sSqlWhere = @" WHERE (Created BETWEEN '" + sFromTime + @"' AND '" + sToTime + @"')";// and (IATA='" + sIata + @"')";
string sSqlLike = @" LIKE '%" + sPasssengerL + "'%";
SqlDataReader sqlReader = null;
try {
SqlCommand sqlCommand = new SqlCommand(sSqlSelect + @"dbo.BagData" + sSqlWhere + sSqlLike, this.dbConnection);
sqlReader = sqlCommand.ExecuteReader();
if(!sqlReader.Read()) {
sqlReader.Close();
sqlCommand.CommandText = sSqlSelect + @"dbo.BagDataHistory" + sSqlWhere + sSqlLike;
sqlReader = sqlCommand.ExecuteReader();
if(!sqlReader.Read()) {
sqlReader.Close();
sqlCommand.CommandText = sSqlSelect + @"dbo.BagDataArchive" + sSqlWhere + sSqlLike;
sqlReader = sqlCommand.ExecuteReader();
if(!sqlReader.Read()) {
sqlReader.Close();
}
}
}
if(!sqlReader.IsClosed) {
sPasssengerL = this.GetSqlDataString(@"Passenger", sqlReader);
sqlReader.Close();
}
}
catch(SqlException x) {
MessageBox.Show(@"GetPassengerName(): SQL Exception: " + x.Message, this.GetHashString("Error"), MessageBoxButton.OK, MessageBoxImage.Error);
}
catch(Exception ex) {
MessageBox.Show(@"GetPassengerName(): General Exception: " + ex.Message, this.GetHashString("Error"), MessageBoxButton.OK, MessageBoxImage.Error);
}
finally {
if(sqlReader != null) {
if(!sqlReader.IsClosed) {
sqlReader.Close();
}
}
}
return sPasssengerL;
}
}
作为一方,你应该使用参数。连接字符串以形成查询是一个非常糟糕的安全问题。例如'select * from @tableName where @Foo = @ Bar' then sqlCommand.Parameters.AddWithValue(“@ tableName”,“yourTableName”);' – Stuart
'sSqlWhere'定义在哪里? –
@TimothyG。 sSqlWhere是在我的代码中定义的,虽然我故意省略它,但我的关注点更多地在sSqlLike –