在Select中使用AND -Where

Question

我尝试在SELECT语句中使用AND，如下所示：

sqlc.ConnectionString = "Data source=. ; Database=LDatabase; integrated security=true";
    cmd.Connection=sqlc;
    cmd.CommandText = "select * from Books where Title like '" + txtboxbook.Text + "' and Author like '" + txtboxAuthor.Text + "'";

    sqlc.Open();
    SqlDataReader  R=cmd.ExecuteReader();
    GridView1.DataSource=R;
    GridView1.DataBind();
    if (R.HasRows == false)
        LMsg.Text = "No Items were found";
    else
        LMsg.Text =  GridView1.Rows.Count.ToString()+"Items were found";
    R.Close();
    sqlc.Close(); 

当我使用一个没有AND的条件时，它可以完美地工作，但是当我添加那个麻烦的AND时，它找不到我搜索的东西吗？

Answer 1

您真的应该考虑使用parameterized query。

//cmd.CommandText = "select * from Books where Title like '" + txtboxbook.Text + "' and Author like '" + txtboxAuthor.Text + "'";
cmd.CommandText = "select * from Books where Title like @title and Author like @author";
cmd.Parameters.AddWithValue("@title", txtboxbook.Text);
cmd.Parameters.AddWithValue("@author", txtboxAuthor.Text); 

Select *也是不好的做法。仅选择所需的列。