sql的小问题

#region zhoush add on 2009-5-13
  public static string GetCustomerIDByCustomercode(string Customercode)
  {
   string CustomerID=null;
   string sqlstr="select Customer_ID from tb_notification where customercode='"+Customercode+"'";
   SqlCommand Cmd=new SqlCommand(sqlstr,ReturnConn());
   SqlDataReader Dr=Cmd.ExecuteReader();
   while(Dr.Read())
   {
    CustomerID=Dr["Customer_ID"].ToString();
   }
   Dr.Close();
   return CustomerID;
  }
  #endregion

 string sqlstr="select Customer_ID from tb_notification where customercode='"+Customercode+"'";
注意在后面加上单号！