c# 查询mysql,参数化查询MySQL的使用C＃

I have the code below (I've included what I believe are all relevant sections):

private String readCommand = "SELECT LEVEL FROM USERS WHERE VAL_1 = ? AND VAL_@ = ?;";

public bool read(string id)

{

level = -1;

MySqlCommand m = new MySqlCommand(readCommand);

m.Parameters.Add(new MySqlParameter("", val1));

m.Parameters.Add(new MySqlParameter("", val2));

MySqlDataReader r = m.ExecuteReader();

if (r.HasRows)

level = Convert.ToInt32(r.GetValue(0).ToString());

r.Close();

return true;

}

When I run this, I get an IndexOutOfBoundsException on adding the first parameter. What have I done wrong?

解决方案

Try this instead:

private String readCommand = "SELECT LEVEL FROM USERS WHERE VAL_1 = @param_val_1 AND VAL_2 = @param_val_2;";

public bool read(string id)

{

level = -1;

MySqlCommand m = new MySqlCommand(readCommand);

m.Parameters.AddWithValue("@param_val_1", val1);

m.Parameters.AddWithValue("@param_val_2", val2);

level = Convert.ToInt32(m.ExecuteScalar());

return true;

}