SQLDataReader未读取

Question

我正在尝试制作一个警报系统，用于检查与患者相关的过敏症的药物链接过敏（请参阅下图）。

当我运行它似乎只是完全跳过SqlDataReader的代码，我已经当（reader.HasRows）进行检查，它只是显示有在读者没有行。我想要做的就是在阅读器的最后显示一个带有选定过敏名称的消息框。我正在使用SQL Server 2014.任何帮助将不胜感激。所有的SqlCommand的

private void button_addItem_Click(object sender, RoutedEventArgs e) 
{ 
    if (!string.IsNullOrEmpty(comboBox_select_Item.Text.ToString())) 
    { 
     using (SqlConnection conn = new SqlConnection(connection)) 
     { 
      try 
      { 
       SqlCommand sqlCmd2 = new SqlCommand("SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE A.allergyID = PA.allergyID AND PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = " + comboBox_select_Item.SelectedValue.ToString() + ")", conn); 
       conn.Open(); 
       SqlDataReader sqlReader = sqlCmd2.ExecuteReader(); 
       Allergies allergies = new Allergies(); 

       while (sqlReader.Read()) 
       { 
        allergies.allergyName = Convert.ToString(sqlReader["allergyName"]); 
        allergies.allergyDescription = Convert.ToString(sqlReader["allergyDescription"]); 
       } 

       MessageBox.Show(allergies.allergyName); 
       sqlReader.Close(); 
       FillSalesItemGrid(); 
      } 
      catch (Exception ex) 
      { 
       MessageBox.Show(ex.ToString(), ex.ToString()); 
      } 
     } 
    } 
} 

Answer 1

首先是容易受到SQL注入攻击 - 你应该总是使用SqlParameter的，因为它可以帮助您防止SQL注入。 所以你的SqlCommand应该是这样的：

SqlCommand sqlCmd2 = new SqlCommand("SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE A.allergyID = PA.allergyID AND PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = @medID)", conn); 

，你可以传递参数：

sqlCmd2.Parameters.AddWithValue("@medID",comboBox_select_Item.SelectedValue); 

更重要的是，在您的查询下面的语句是多余的

WHERE A.allergyID = PA.allergyID 

，因为你有INNER加入此域

FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID 

，因此您可以从您的查询

SELECT allergyName, allergyDescription FROM Allergies A INNER JOIN PatientAllergies PA ON A.allergyID = PA.allergyID WHERE PA.allergyID = (SELECT allergyID FROM Medication_Allergies MA WHERE MA.medID = @medID) 

删除冗余的发言中，我敢肯定，你的代码的其余部分是或多或少的罚款。请看看你的查询是否返回任何行。例如，你可以复制你的查询，并用comboBox中的值替换@medID。