2013-07-22 19 views
1
Imports System.Data 
Imports System.Data.SqlClient 


Public Class Form2 
    Private Sub button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click 
     Dim cmd As SqlCommand 
     Dim conn As SqlConnection 
     Dim dr2 As SqlDataReader 

     Dim sql = "SELECT room number,date,ddate FROM date WHERE room number = '" & nametxt.Text & "' AND date >= '" & DateTimePicker1.Text & "'AND ddate <= '" & DateTimePicker1.Text & "'OR Room number = '" & nametxt.Text & "'AND date = '" & DateTi mePicker1.Text & "' " 
     conn = New SqlConnection("Data Source=zahid\sqlexpress;Initial Catalog=test;Integrated Security=True") 
     conn.Open() 

     cmd = New SqlCommand(sql, conn) 


     Try 
      dr2 = cmd.ExecuteReader 
      If dr2.Read = True Then 
       MessageBox.Show("room not available...") 
      Else 
       MessageBox.Show("Login Successful...") 
      End If 
     Catch ex As Exception 
      MsgBox(ex.Message) 
     End Try 

     If conn.State <> ConnectionState.Closed Then 
      conn.Close() 
     End If 

    End Sub 
End Class 

回答

1

当你有一个字段名称中带有空格,你应该括在方括号

Dim sql = "SELECT [room number,date,ddate FROM date WHERE [room number] = " & _ 
     "'" & nametxt.Text & "' AND date >= '" & DateTimePicker1.Text & _ 
     "'AND ddate <= '" & DateTimePicker1.Text & "'OR [Room number] = '" & _ 
     "nametxt.Text & "'AND date = '" & DateTimePicker1.Text & "' " 

说您应该绝对删除字符串连接并使用参数化查询。 我把还parenthesys更好地组逻辑条件

Dim sql = "SELECT [room number],date,ddate FROM date WHERE " & _ 
      "([room number] = @rnum AND date >= @dt AND ddate <= @dt) " & _ 
      " OR ([Room number] = @rnum AND date = @dt)" 

现在查询文本简化与参数,你可以很容易地看到,不需要条件,或因为它已经包含在第一个块。

所以,你的代码可以写成

Dim sql = "SELECT [room number],date,ddate FROM date WHERE " & _ 
      "[room number] = @rnum AND date >= @dt AND ddate <= @dt " 

Using conn = New SqlConnection("Data Source=zahid\sqlexpress;Initial Catalog=test;Integrated Security=True") 
Using cmd = New SqlCommand(sql, conn) 
    conn.Open() 
    cmd.Parameters.AddWithValue("@rnum", nametxt.Text) 
    cmd.Parameters.AddWithValue("@dt", DateTimePicker1.Value) 
    Try 
     Using dr2 = cmd.ExecuteReader 
      ' Probably this test is wrong.... 
      If dr2.Read = True Then 
       MessageBox.Show("room not available...") 
      Else 
       MessageBox.Show("Login Successful...") 
      End If 
     End Using 
    Catch ex As Exception 
     MsgBox(ex.Message) 
    End Try 
End Using 
End Using 
If conn.State <> ConnectionState.Closed Then 
    conn.Close() 
End If 
相关问题