Can'tseemtogetaDataReadertoworkinC#/SQLServer

I have this code:

我有这个代码:

string strCOnnect= "Server=DESKTOP-2Q73COU\\SQLEXPRESS;Database=LoginApp;Trusted_COnnection=True;";
SqlConnection cOnn= new SqlConnection(strConnect);
conn.Open();

MessageBox.Show("Connected to SSMS.");

string loadMainInfo = "SELECT * FROM Main_Information WHERE Username = " + Globals.username;

SqlCommand cmd = new SqlCommand(loadMainInfo, conn);

SqlDataReader dr = cmd.ExecuteReader();

if (dr.Read())
{
    lblStanding.Text = (dr["Standing"].ToString());
    lblName.Text = (dr["First Name"].ToString()) + " " + (dr["Last Name"].ToString());
    lblTotalHours.Text = (dr["Total_hours"].ToString());
    lblType.Text = (dr["Degree_type"].ToString());
    lblDegree.Text = (dr["Degree"].ToString());
    lblCurrentHours.Text = (dr["Current_hours"].ToString());
}

Specifically this line:

特别是这一行:

string loadMainInfo = "SELECT * FROM Main_Information WHERE Username = " + Globals.username;

If I replace the end of that line with:

如果我用以下内容替换该行的结尾:

Username = testuser"

The code will work fine and all labels below will be populated with the corresponding info from the tables where Username = testuser. However, if the user logs in with their username and the code is using the original line, I get this error:

代码将正常工作,下面的所有标签将填充Username = testuser表中的相应信息。但是,如果用户使用其用户名登录并且代码使用的是原始行,则会收到以下错误:

System.Data.SqlClient.SqlException: 'Incorrect syntax near '='.'

System.Data.SqlClient.SqlException:''''附近的语法不正确。

Any help?

4 个解决方案

string loadMainInfo = "SELECT * FROM Main_Information WHERE Username = @paramName"'; 
SqlParameter param1 = new SqlParameter () ; 
param1.ParameterName="@paramName";
param1.SqlDbType= SqlDbType.Varchar;
param1.Value= Globals.username;
cmd.Parameters.Add(param1);

string loadMainInfo = "SELECT * FROM Main_Information WHERE Username = '" + Globals.username + "'";

string loadMainInfo = String.Format(“SELECT * FROM Main_Information WHERE Username = {0}" ,Globals.username);