我正在尝试使用SELECT语句在数据库中“选择”一个人,而且无论如何都不会选择正确的人,我也不知道为什么。
我正在使用一个Access数据库。
数据库连接代码:
Imports System.Data.OleDb Module Database_Connection Public provider As String 'This will tell VS what database source type to use. Public datafile As String 'This will provide the file itself that VS will use. Public connstring As String 'This is the connection string that will tie the Provider and Datafile together so that we can make a physical connection Public myconnection As OleDbConnection = New OleDbConnection 'Set's the variable myconnection as a new Connection to the database using the OleDb type. Public dr As OleDbDataReader 'This will be used to read data from the database. Public Sub Access_Database() provider = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source =" datafile = "Folly_Beach_Data.accdb" connstring = provider & datafile myconnection.ConnectionString = connstring Try myconnection.Open() 'Opens the connection to test it. Catch ex As Exception MessageBox.Show("Error" & vbCrLf & vbCrLf & "Original Error: " & ex.ToString) 'This is an error that most likely many people will recieve on their computers. I noticed the problem a 'while ago and looked for a way to fix it. This is both the easiest and only method to correct the error stated below. 'It doesn't force you to download anything, you have to select the option to do so. If MsgBox("If you received an error that states: " & vbCrLf _ & Quotes & "The microsoft.ACE.OLEDB.12.0' provider is not registered on the local machine." _ & Quotes & "Please press ok to install the database engine: ", MsgBoxStyle.OkCancel, _ "Error") = MsgBoxResult.Ok Then System.Diagnostics.Process.Start("http://www.microsoft.com/en-us/download/confirmation.aspx?id=23734") 'This opens the webpage to directly download the file. As soon as you press okay on the messagebox the file is 'instantly ready for download. ElseIf MsgBoxResult.Cancel Then MessageBox.Show("Here is the link for future reference if you would like to download it at a later time: " _ & vbCrLf & vbCrLf & "http://bit.ly/19FWu09", "For later") 'I case you are untrusting of the file or cannot download it at the present time, it gives a link for later installation ConnectionError = True 'For Description view "MyVariables" myconnection.Close() 'Closes the connection End If Finally 'If myconnection.State = ConnectionState.Open Then ' MessageBox.Show("The database was successfully connected to", "Success", MessageBoxButtons.OK) 'End If ConnectionError = False myconnection.Close() 'Closes the connection so we can open at a later time. 'Trying to re-use or re-open a connection string will crash the progrm. End Try End Sub
终端模块
这是我在代码中选择此人的地方:
请注意,我正在检查电话号码和邮政编码,以查看该人是否是该人。(我知道这是不安全的。这是一个学校项目)。因此,我在一开始就使用了两个SELECT语句来检查人员信息。并且它可以正常工作。如果电话号码是正确的,但邮编不是,则表明它不正确并且不会继续。我这样做就像嵌套的SELECT语句一样。
Private Sub ReturningCheck() Dim Phone As String = Phonetxt.Text Dim Zip As String = ziptxt.Text GuestFound = False Try myconnection.Open() Dim str As String str = "SELECT * FROM Customers WHERE Customer_Phone_Number='" & Phone & "'" Dim cmd As OleDbCommand = New OleDbCommand(str, myconnection) dr = cmd.ExecuteReader If dr.Read Then str = "Select * FROM Customers WHERE Customer_Address_Zip='" & Zip & "'" cmd = New OleDbCommand(str, myconnection) dr = cmd.ExecuteReader If dr.Read Then GuestName = dr("Customer_Name") MessageBox.Show("Welcome back " & GuestName & ".") GuestFound = True Else MessageBox.Show("The Phone number Matches but the zipcode does not, please re-enter the zip code that you first signed up with.") ziptxt.Focus() ziptxt.SelectAll() End If Else MessageBox.Show("That phone number does not exist in our records please re-enter the phone number in the format of 8001231234") Phonetxt.Focus() Phonetxt.SelectAll() End If Catch ex As Exception MessageBox.Show("There was an error retrieving your information from the database" _ & vbCrLf & vbCrLf & "Original Error: " & ex.ToString, _ "Error", MessageBoxButtons.OK, MessageBoxIcon.Error) Finally myconnection.Close() End Try End Sub
我尝试在数据库中做最后一个人,但是它返回了第二个人的名字,那么这有什么问题呢?任何帮助将不胜感激。
而不是连续调用两个SQL语句,而是将条件合并到单个SQL语句的where子句中,如下所示:
str = "SELECT * FROM Customers WHERE Customer_Phone_Number='" & Phone & _ "' AND Customer_Address_Zip='" & Zip & "'"
如下面的建议,您应该修复您的代码,以确保其免受SQL攻击。简而言之,只要您在用户输入的字段中插入字符串,就需要对其进行清理。实现此目的的最佳方法是使用参数化查询。请搜索“ VB中的参数化查询”,您会发现很多示例。