简单的SELECT在C＃中抛出“附近有语法错误‘=’”

Question

我试图使用从我的数据库中的数据SqlDataReader的

但我得到一个语法错误获得“System.Data.SqlClient.SqlException ：'='“附近的语法不正确，我不知道它的含义。

这是我的代码

cmd = new SqlCommand("Select Submission_Attachment as Path from Tasks where Submission_FileName =" + FileName, con); 
reader = cmd.ExecuteReader(); 
while (reader.Read()) 
{ 
    FilePath = reader["Path"].ToString(); 
    TextBox1.Text = FilePath; 
} 

有错误示出了在读取器= cmd.ExecuteReader（）;

Answer 1

使用参数来避免SQL注入。

您的当前字符串未被引起错误的单引号包围。

string sqlText = "Select Submission_Attachment as Path from Tasks where Submission_FileName = @fileName"; 
cmd = new SqlCommand(sqlText, con); 
cmd.Parameters.AddWithValue("@fileName", FileName); 
reader = cmd.ExecuteReader(); 

Answer 2

Submission_FileName可能是一个字符串（varchar）字段。您需要用单引号将值包装起来：

cmd = new SqlCommand("Select Submission_Attachment as Path from Tasks where Submission_FileName = '" + FileName + "'", con); 

仍然需要使用参数化查询来抵消SQL注入。

Answer 3

cmd = new SqlCommand("Select Submission_Attachment as Path from Tasks where Submission_FileName = @filename", con); 
cmd.Parameters.Add("@filename", SqlDbType.VarChar, [varchar length here]).Value = FileName; 
reader = cmd.ExecuteReader(); 
while (reader.Read()) 
{ 
    FilePath = reader["Path"].ToString(); 
    TextBox1.Text = FilePath; 
}