c# - SQL查询执行难度

Question

我在从应用程序添加学生时进行验证。如果我运行以下查询

SELECT ID FROM Student WHERE Name =' " '+str+' " '

它将产生以下错误:

Invalid column name 'str'.

我的应用程序将生成 DBException。

我该如何解决这个问题？

编辑

String SName=txtBox1.Text;

String sql="select id from student where name = ' "+SName.Trim()+" ' ";

SqlConnection connection = null;
SqlDataReader reader = null;
try
{
    connection = GetConnection();
    SqlCommand command = new SqlCommand(sql, connection);
    if (_sqltransection != null)
    {
        command.Transaction = _sqltransection;
    }
    reader = command.ExecuteReader(CommandBehavior.CloseConnection);
}            
catch (SqlException ex)
{
    throw new DBException(ex);
}

哪里 txtBox.Text="'+str+' "

Answer 1

SELECT ID FROM Student WHERE Name =' " '+'divyesh'+' " '

但是没有意义...

也许你会更喜欢这样的东西:

SELECT ID FROM Student WHERE Name like '%divyesh%'

如果要在字符串中添加单个字符:

SELECT '''hello'''