c#和sql 连结中 无法绑定有多个部分组成的标识符 textbox.text

Question

如题所述

Answer 1

加上防注入,所以正确的语句是：
string
SQLString
=
"SELECT
*
FROM
student
where
sno='"+
textBox1.Text.Replace("'",
"''")+"'
AND
password='"+textBox2.Text.Replace("'",
"''")+"'";

Answer 2

string
SQLString
=
"SELECT
*
FROM
student
where
sno='"+
textBox1.Text+"'
AND
password='"+textBox2.Text+"'";