带有c#和where子句的Sqlite

Question

下面的代码运行良好，但是如何在其中添加where子句。

一直在尝试以下字符串: sql =“选择ip_address、名称、模型、mac_address、operating_system、current_userfrom设备，其中ip_address = @192.168.0.56"；

using System;
using System.Data.SQLite;
using System.IO;


namespace SQLiteSamples
{
    class Program
    {
        // Holds our connection with the database
        SQLiteConnection m_dbConnection;


        public string Info { get; private set; }

        static void Main(string[] args)
        {
            Program p = new Program();
        }

        public Program()
        {

            connectToDatabase();            
            printResult();
        }



        // Creates a read only connection to spiceworks database file.
        void connectToDatabase()
        {
            //m_dbConnection = new SQLiteConnection(@"Data Source=\\spiceworks\db\spiceworks_prod.db;Version=3;Read Only=True");
            m_dbConnection = new SQLiteConnection(@"Data Source=C:\Temp\ZipSampleExtract\db\spiceworks_prod.db;Version=3;Read Only=True");        
            m_dbConnection.Open();
        }




        // Writes the output from spiceworks table devices.
        void printResult()
        {

            string sql = "select [ip_address], [name], [model], [mac_address], [operating_system], [current_user]from [devices]";
            SQLiteCommand command = new SQLiteCommand(sql, m_dbConnection);
            SQLiteDataReader reader = command.ExecuteReader();

            while (reader.Read())

           Console.WriteLine("ip_address: " + reader["ip_address"] + "  " + reader["name"] + "  " + reader["model"] + "  " + reader["mac_address"]+"  " + reader["operating_system"] + "  " + reader["current_user"]);
           Info = Convert.ToString(Console.ReadLine());
           File.WriteAllText("E:\\johnb.txt", Info);

       }

    }
}

Answer 1

SQL中的字符串文字用单引号表示：

string sql = "select [ip_address], [name], [model], [mac_address], [operating_system], [current_user] from [devices] where [ip_address] = '192.168.0.56'";

Answer 2

您将希望在最终项目中使用参数来防止SQL注入。

    string sql = "select [ip_address], [name], [model], [mac_address], [operating_system], [current_user]from [devices] where [ip_address] = @ip_address";
    SQLiteCommand command = new SQLiteCommand(sql, m_dbConnection);
    command.Parameters.Add(new SqlParameter("@ip_address", ipAddressValue));

    SQLiteDataReader reader = command.ExecuteReader();