c# - asp.net - 如何在 Sql 中使用变量？

Question

我有一个问题。如何在 SQL 问题中使用变量？此代码不起作用:

   cmd.CommandText = "select Id, Name from tblFiles WHERE email = 'CurrentUser'";
   cmd.CommandText = "select Id, Name from tblFiles WHERE email = '+CurrentUser'";
   cmd.CommandText = "select Id, Name from tblFiles WHERE email = '$CurrentUser'";
   cmd.CommandText = "select Id, Name from tblFiles WHERE email =' +CurrentUser'";
   cmd.CommandText = "select Id, Name from tblFiles WHERE email = CurrentUser";

我必须从电子邮件为 CurrentUser = User.Identity.Name 的数据库日期下载。

 private void BindGrid()
    {
        string CurrentUser = User.Identity.Name;
        string constr = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString;
        using (SqlConnection con = new SqlConnection(constr))
        {

            if (CurrentUser != null)
            {
             using (SqlCommand cmd = new SqlCommand())
             {
                GridView GridView1 = LoginView3.FindControl("GridView1") as GridView;
                cmd.CommandText = "select Id, Name from tblFiles WHERE email = 'CurrentUser'";
                cmd.Connection = con;
                con.Open();
                GridView1.DataSource = cmd.ExecuteReader();
                GridView1.DataBind();
                con.Close();
             }
         }
     }
 }

Answer 1

你需要利用Parameters

    cmd.CommandText = "select Id, Name from tblFiles WHERE email = @CurrentUser";
    cmd.Parameters.Add("@CurrentUser", SqlDbType.NVarChar);
    cmd.Parameters["@CurrentUser"].Value = User.Identity.Name;