2012-12-17 76 views
0

新问题。 我有这个作为我的gridview,我想要它,所以当页面加载网格视图充满了数据库信息。ASP.NET GridView更新/整体查询结构

所以下面是gridview的代码。以下是c#代码。

UPDATE

<asp:GridView ID="RegistrantsView" runat="server" AllowPaging="True" 
       AllowSorting="True" AutoGenerateColumns="True" 
       CellPadding="4" 
       ForeColor="#333333" GridLines="None"> 
       <AlternatingRowStyle BackColor="White" ForeColor="#284775" /> 
       <EditRowStyle BackColor="#999999" /> 
       <FooterStyle BackColor="#5D7B9D" Font-Bold="True" ForeColor="White" /> 
       <HeaderStyle BackColor="#5D7B9D" Font-Bold="True" ForeColor="White" /> 
       <PagerStyle BackColor="#284775" ForeColor="White" HorizontalAlign="Center" /> 
       <RowStyle BackColor="#F7F6F3" ForeColor="#333333" /> 
       <SelectedRowStyle BackColor="#E2DED6" Font-Bold="True" ForeColor="#333333" /> 
       <SortedAscendingCellStyle BackColor="#E9E7E2" /> 
       <SortedAscendingHeaderStyle BackColor="#506C8C" /> 
       <SortedDescendingCellStyle BackColor="#FFFDF8" /> 
       <SortedDescendingHeaderStyle BackColor="#6F8DAE" /> 
      </asp:GridView> 

C#:

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["FFL-New DataConnectionString"].ConnectionString); 

protected void Page_Load(object sender, EventArgs e) 
{ 
    connection.Open();//opens connection on page load 
    SqlCommand selectAllCommand = new SqlCommand(); 
    selectAllCommand.CommandText = "select * from registrants"; 
    selectAllCommand.Connection = connection; 

    SqlDataAdapter sda = new SqlDataAdapter(); 
    sda.SelectCommand = selectAllCommand; 

    DataTable dt = new DataTable(); 
    sda.Fill(dt); 

    RegistrantsView.DataSource = dt; 
    RegistrantsView.DataBind(); 
} 

回答

0

首先你要注意,你的查询是容易SQL Injections这是一个安全风险

相反的ExecuteNonQuery的使用DataAdapter和填充一个DataTable,然后设置RegistrantsView 数据源DataBind前:

protected void SearchButton_Click(object sender, EventArgs e) 
{ 
    string searchBoxValue = SearchBox.Text; 
    string columnNameValue = ColumnName.SelectedValue; 
    columnNameValue.ToLower(); 

    string sqlQuery = "select * from registrants"; 
    DataTable dt = new DataTable(); 

    using (SqlCommand searchCommand = new SqlCommand(sqlQuery, connection)) 
    { 
     connection.Open(); 
     using (SqlDataReader reader = cmd.ExecuteReader()) 
     { 
       dt.Load(reader); 
     } 
    } 

    RegistrantsView.DataSource = dt; 
    RegistrantsView.DataBind(); 
} 

如果这是在pageLoad的:

protected void Page_Load(object sender, EventArgs e) 
{ 
    if (!IsPostback) 
    { 
     string sqlQuery = "select * from registrants"; 
     DataTable dt = new DataTable(); 
     using (SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["FFL-New DataConnectionString"].ConnectionString)) 
     { 
      using (SqlCommand searchCommand = new SqlCommand(sqlQuery, connection)) 
      { 
       connection.Open(); 
       using (SqlDataReader reader = cmd.ExecuteReader()) 
       { 
         dt.Load(reader); 
       } 
      } 
     } 
     RegistrantsView.DataSource = dt; 
     RegistrantsView.DataBind(); 
    } 
} 
+0

我会使用参数化查询,我明白为什么现在。但我现在有另一个问题。我仍然使用搜索框来抓取用户的输入。我仍然可以接受SQL注入吗?我应该摆脱搜索框功能吗? – j0hnstew

+0

@stewbydoo - 不要摆脱搜索框功能,只是不要使用'“select * ... where myColumn =”+ searchTextBox.Text'使用** [参数](http://www.dotnetperls .com/sqlparameter)**而不是 – Blachshma

+0

试过这个,它导致一个错误,其中DataSource和DataSource ID都被调用,因此它告诉我使用其中一个或另一个。 – j0hnstew