SqlCommand AddWithValue

Question

SqlCommand command = new SqlCommand("SELECT * FROM users WHERE Username =  ? AND Password = ?", connection);
command.Parameters.AddWithValue("Username", username);
command.Parameters.AddWithValue("Password", password);
SqlDataReader reader = null;
reader = command.ExecuteReader();

当我运行程序时

语法错误在“？”附近。

在这条线上：

reader = command.ExecuteReader();

有人能看到我做错了什么吗？

Answer 1

using(SqlCommand command = new SqlCommand("SELECT * FROM users WHERE Username =  @Username AND Password = @Password", connection))
{
  command.Parameters.AddWithValue("@Username", username);
  command.Parameters.AddWithValue("@Password", password);
  using(SqlDataReader reader = command.ExecuteReader())
  {
    while(reader.Read())
    {
      //do actual works
    }
  }
}

使用using关键字进行改进，这是不必要的，但建议

Answer 2

SqlCommand command = new SqlCommand(
    "SELECT * FROM users WHERE Username = @Username AND Password = @Password",
    connection);
command.Parameters.AddWithValue("Username", username);
command.Parameters.AddWithValue("Password", password);
SqlDataReader reader = null;
reader = command.ExecuteReader();

您可能需要阅读sql。

Answer 3

您使用的是哪个DBMS？如果使用的是Server，则查询的语法不正确。你需要：

SqlCommand cmd = 
    new SqlCommand(@"select * 
                     from users 
                     where username = @username and password = @password");

command.Parameters.AddWithValue("@username", username);
command.Parameters.AddWithValue("@password", password);