vb.net - da.fill ')' 附近的语法不正确

Question

我遇到了问题

da.Fill(ds, "Employee")

我没有任何线索来解决这个问题。任何人都可以帮忙吗？

这是我的实际代码:

 Private Sub btnsearch_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnsearch.Click
    Dim da As New SqlClient.SqlDataAdapter
    Dim ds As New DataSet
    Dim dt As New DataTable


    If txtssn.Text = "" Then
        MsgBox("Please input SSN.", MsgBoxStyle.Exclamation, "Company Records - Employee")
    Else
        con.Open()
        Dim cmd As New SqlCommand("SELECT * FROM [Employee] WHERE [Ssn] = '" & Trim(Me.txtssn.Text) & "')", con)

        da.SelectCommand = cmd

        da.Fill(ds, "Employee")
        dt = ds.Tables("Employee")

        If (dt.Rows.Count > 0) Then
            Me.txtfname.Text = dt.Rows(0).Item(1)
            Me.txtmi.Text = dt.Rows(0).Item(2)
            Me.txtlname.Text = dt.Rows(0).Item(3)
            Me.dtpbdate.Text = dt.Rows(0).Item(5)
            Me.txtaddress.Text = dt.Rows(0).Item(6)
            Me.cmbsex.Text = dt.Rows(0).Item(7)
            Me.txtsalary.Text = dt.Rows(0).Item(8)
            Me.cmbsuperssn.Text = dt.Rows(0).Item(9)
            'Me.cmbdept.Text =
            btnedit.Enabled = True
            btndelete.Enabled = True
            editable()

        Else
            MsgBox("Record Not Found", MsgBoxStyle.Information + MsgBoxStyle.OkOnly, "Company Records - Employee")
        End If

        con.Close()
    End If

Answer 1

删除右括号，因为那是 SELECT不是 INSERT :

"SELECT * FROM [Employee] WHERE [Ssn] = '" & Trim(Me.txtssn.Text) & "'"

但是，我总是使用 sql 参数来防止 sql 注入(inject)。

Using con As New SqlConnection("ConenctionString")
    Using da As New SqlDataAdapter("SELECT * FROM [Employee] WHERE [Ssn] = @SSN", con)
        da.SelectCommand.Parameters.Add("@SSN", SqlDbType.VarChar).Value = txtssn.Text
        da.Fill(ds, "Employee")
    End Using
End Using