how to make search of a string in a data base in c#

前端 未结 1 1478
情话喂你
情话喂你 2021-01-27 00:41

This is the code that is used to make the search

 private void button1_Click(object sender, EventArgs e)
    {
        string connectionString = Tyre.Properties         


        
相关标签:
1条回答
  • 2021-01-27 01:13

    First off, your code is wide open to SQL Injection. You allow the user to insert any data he wants including

    ; DROP TABLE table1

    To fix the immediate issue surround the item to be matched with single quotes and % signs:

    "SELECT * FROM table1 where Nom like '%" + textBox1.Text + "%'"
    

    However, you absolutely should look into using a parameterized query.

    0 讨论(0)
提交回复
热议问题