日期:2014-05-18 浏览次数:20558 次
int id = System.Convert.ToInt32(Request.Params["id"]); int nid = System.Convert.ToInt32(Request.Params["nclassid"]); if (!IsPostBack) { my_conn.Open(); OleDbCommand my_comm = new OleDbCommand("select * from info where [color=#FF0000]nclassid=" + nid + " and [/color]id=" + id + "", my_conn);//这一句是不是有问题? Repeater1.DataSource = my_comm.ExecuteReader(); Repeater1.DataBind(); DataSet myDataSet = new DataSet(); }
select * from info where nclassid ='" + nid + "' and id='" + id + "'"
------解决方案--------------------
OleDbCommand my_comm = new OleDbCommand("select * from info where [color=#FF0000]nclassid=@nid and id=@id", my_conn); myCommand.Parameters.Add(new SqlParameter("@nid", SqlDbType.Int)); myCommand.Parameters["@nid"].Value = nid; myCommand.Parameters.Add(new SqlParameter("@id", SqlDbType.Int)); myCommand.Parameters["@id"].Value = id;