c# - mysql语法错误

Question

我收到一个错误，不确定如何修复:

ERROR [HY000] [MySQL][ODBC 3.51 Driver][mysqld-5.5.9]Column 'UserID' in field list is ambiguous

我的代码:

using System.Data.Odbc;

public partial class Search : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }
    private void PopulateWallPosts(string search)
    {

        using (OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=root; Password=commando;"))
        {
            cn.Open();
            using (OdbcCommand cmd = new OdbcCommand("SELECT UserID, FirstName, SecondName, p.PicturePath FROM User LEFT JOIN Pictures p ON p.UserID = u.UserID WHERE FirstName LIKE '%" + search + "%' ORDER BY UserID DESC", cn))
            {
                using (OdbcDataReader reader = cmd.ExecuteReader())
                {
                    test1.Controls.Clear();

                    while (reader.Read())
                    {

                        System.Web.UI.HtmlControls.HtmlGenericControl div = new System.Web.UI.HtmlControls.HtmlGenericControl("div");
                        div.Attributes["class"] = "test";


                        div.ID = String.Format("{0}", reader.GetString(0)); //userid
                        string id = Convert.ToString(div.ID);
                        //store the div id as a string
                        Image img = new Image();
                        img.ImageUrl = String.Format("{0}", reader.GetString(3)); //p.picturepath
                        img.AlternateText = "Test image";

                        div.Controls.Add(img);
                        div.Controls.Add(ParseControl(String.Format("&nbsp&nbsp " + "{0} {1}", reader.GetString(1), reader.GetString(2)))); // FirstName, SecondName
                        div.Attributes.Add("onclick", "confirm_delete(" + id + ");");
                        // send the div id to javascript
                        div.Style["clear"] = "both";
                        test1.Controls.Add(div);

                    }
                }
            }
        }
    }
    protected void Button2_Click(object sender, EventArgs e)
    {


        string search = TextBox2.Text;

        PopulateWallPosts(search);

        }
    }

表结构:

Answer 1

尝试指定您在查询中使用的 UserId 列:

using (OdbcCommand cmd = new OdbcCommand("SELECT u.UserID, u.FirstName, u.SecondName, p.PicturePath FROM User u LEFT JOIN Pictures p ON p.UserID = u.UserID WHERE u.FirstName LIKE '%" + search + "%' ORDER BY u.UserID DESC", cn))

此外，我建议您使用 MySQL ADO.NET driver/connector而不是 ODBC。最后使用参数化查询，因为当前您的代码很容易受到 SQL 注入(inject)的影响，因为 search 参数的这种字符串连接。

因此，您的改进代码可能如下所示:

using (var cn = new MySqlConnection("Server=localhost; Database=gymwebsite2; User=root; Password=commando;"))
using (var cmd = cn.CreateCommand())
{
    cn.Open();
    cmd.CommandText = "SELECT u.UserID, u.FirstName, u.SecondName, p.PicturePath FROM User u LEFT JOIN Pictures p ON p.UserID = u.UserID WHERE u.FirstName LIKE '@search' ORDER BY u.UserID DESC";
    cmd.Parameters.AddWithValue("@search", search);
    using (var reader = cmd.ExecuteReader())
    {
        test1.Controls.Clear();
        while (reader.Read())
        {
            ...
        }
    }
}