c# - '00' 附近的语法不正确

Question

我是 asp 和 sql server 的新手。我在 sql 查询中遇到问题。

string obal ;
        decimal _obalss = 0;
        decimal obalss = 0;
        sconnection c = new sconnection();
        string cus_id = Session["cusid"].ToString();
        DateTime maxdate = DateTime.Parse(fromdt.Text, new System.Globalization.CultureInfo("en-US"));
        string mdate = maxdate.ToString();
        string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 
        SqlDataReader dr = c.reader(query_sl);
        if (dr.Read())
        {
            decimal.TryParse(dr["amount"].ToString(), out _obalss);
            obalss = _obalss;
        }
        else
        {
            obalss = 0;
        }
            dr.Close();
            dr.Dispose();

Answer 1

 string query_sl = "select sum(amount) as amount from sale where cusid = " + cus_id + " and invdate < " + maxdate + " group by cusid"; 

maxdate 是一个日期，你必须把它放在单引号里。更好的是，您应该使用参数化 SQL 查询，否则您很容易受到 SQL 注入(inject)攻击。像这样的事情怎么样:

string query_sl = "select sum(amount) as amount from sale where cusid = @CUSID and invdate < @MAXDATE group by cusid"; 
using(SqlCommand cmd = new SqlCommand(query_sl, c))
{
    cmd.Parameters.Add(new SqlParameter("@CUSID", SqlDbType.Int)).Value = cus_id;
    cmd.Parameters.Add(new SqlParameter("@MAXDATE", SqlDbType.DateTime)).Value = maxdate;
    ...
}