c# - ' ' 附近的语法不正确

Question

这是错误代码背后的页面

if (Session["username"] != null)
   {


        SqlConnection con = new SqlConnection();
        con.ConnectionString = ConfigurationManager.ConnectionStrings["registerCS"].ConnectionString;

       string sql1 = "Select pemgrp from Profile where userID = '" + Session["username"].ToString() + "'";
      string sql = "Select studname from Profile where pemgrp = '" + sql1 + "'";

        SqlCommand cmd = new SqlCommand();
        SqlDataReader dr;

        DataTable dt = new DataTable();

        cmd.CommandText = sql;
        cmd.Connection = con;

        //open connection and execute command
        con.Open();
        dr = cmd.ExecuteReader();

        if (dr.Read())
        {
        lb_classmates.Text = dr[0].ToString();

        }
    }

但是，当我运行时，它给我这个错误:关键字“where”附近的语法不正确。

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near the keyword 'where'.

Answer 1

因为你正在使用子查询，所以这个

string sql = "Select studname from Profile where pemgrp = '" + sql1 + "'";

应该是

string sql = "Select studname from Profile where pemgrp in (" + sql1+ ")";

你应该使用 Parametereized queries避免 SQL injection .