c# - 如何在特定 DataTable 行的剩余列中添加值？

Question

我已经使用 asp.net 和 SQL 服务器为 android 应用程序创建了 Restful API(基于 JSON 的 API)。通过以下链接，我成功地通过 Restful Web 服务从 android 应用程序到 sql server 数据库执行了 CURD 操作:

http://www.tutecentral.com/restful-api-for-android-part-1/

现在我想要的是为 2 个或更多相关的 sql 选择查询创建单个 web 方法并将结果添加到单个数据表中，即在执行第二个查询时将值添加到数据表行的剩余列中。但是当我尝试这样做时我的应用程序崩溃了:

上述场景的 Web 服务方法是:

public DataTable GetStaffProfile(string userid)
{
    String faculty_id="";
    DataTable staffProfile = new DataTable();

   //Adding data to these columns on executing 1st sql query
    staffProfile.Columns.Add(new DataColumn("eid", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("empid", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("userid", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("fname", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("lname", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("fathername", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("dob", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("nationality", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("religion", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("cnic", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("gender", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("domicile", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("designame", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("dname", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("employmentdate", typeof(String)));

//Adding data to these columns on executing 2nd sql query
    staffProfile.Columns.Add(new DataColumn("qualification", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("university", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("majors", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("year", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("city", typeof(String)));
    staffProfile.Columns.Add(new DataColumn("country", typeof(String)));

    if (dbConnection.State.ToString() == "Closed")
    {
        dbConnection.Open();
    }
    string query = "SELECT eid, empid, userid, fname,lname, fathername, dob, nationality, religion, cnic, gender, domicile,(select title from uw_designation where desigid=uw_employee.desigid) as designame,(select dname from uw_department where "
        +"deptid=uw_employee.deptid) as dname, employmentdate FROM uw_employee where userid='"+userid+"'";
    SqlCommand command = new SqlCommand(query, dbConnection);
    SqlDataReader reader = command.ExecuteReader();
    if (reader.HasRows)
    {
        while (reader.Read())
        {
            faculty_id = reader["eid"] as string;
            staffProfile.Rows.Add(reader["eid"], reader["empid"], reader["userid"], reader["fname"], reader["lname"], reader["fathername"], reader["dob"], reader["nationality"],
                reader["religion"], reader["cnic"], reader["gender"], reader["domicile"], reader["designame"], reader["dname"],
                reader["employmentdate"]);
        }
    }
    reader.Close();


    //getting staff qualification


    string query2 = "SELECT TOP(1) eid, qualification, university, majors, year,city,country " +
                    "FROM uw_employee_education where eid='"+faculty_id+"'";
    SqlCommand command2 = new SqlCommand(query2, dbConnection);
    SqlDataReader reader1 = command2.ExecuteReader();
    if (reader1.HasRows)
    {
        while (reader1.Read())
        {
            staffProfile.Rows[0]["qualification"]=reader1["qualification"] as string;
            staffProfile.Rows[0]["university"] = reader1["university"]as string;
            staffProfile.Rows[0]["majors"] = reader1["majors"] as string;
            staffProfile.Rows[0]["year"] = reader1["year"] as string;
            staffProfile.Rows[0]["city"] = reader1["city"] as string;
            staffProfile.Rows[0]["country"] = reader1["country"] as string;
        }
    }
    reader1.Close();

    dbConnection.Close();
    return staffProfile;
}

两个查询只返回一个结果。各种帮助表示赞赏。提前致谢。

Answer 1

你会尝试为第二个查询更改现有的 SqlCommand 吗？

string query2 = "SELECT TOP(1) eid, qualification, university, majors, year,city,country " +
                "FROM uw_employee_education where eid='" + faculty_id + "'";
command.CommandText = query2;
SqlDataReader reader1 = command.ExecuteReader(); 

此外，请在创建 SQL 查询时考虑 SQL 注入(inject)。我建议您使用 SqlParameter。