日期:2014-05-18 浏览次数:20619 次
int id = System.Convert.ToInt32(Request.Params["id"]);
int nid = System.Convert.ToInt32(Request.Params["nclassid"]);
if (!IsPostBack)
{
my_conn.Open();
OleDbCommand my_comm = new OleDbCommand("select * from info where [color=#FF0000]nclassid=" + nid + " and [/color]id=" + id + "", my_conn);//这一句是不是有问题?
Repeater1.DataSource = my_comm.ExecuteReader();
Repeater1.DataBind();
DataSet myDataSet = new DataSet();
}
select * from info where nclassid ='" + nid + "' and id='" + id + "'"
------解决方案--------------------
OleDbCommand my_comm = new OleDbCommand("select * from info where [color=#FF0000]nclassid=@nid and id=@id", my_conn);
myCommand.Parameters.Add(new SqlParameter("@nid", SqlDbType.Int));
myCommand.Parameters["@nid"].Value = nid;
myCommand.Parameters.Add(new SqlParameter("@id", SqlDbType.Int));
myCommand.Parameters["@id"].Value = id;