system.data.sqlclient.sqlException：关键字“from”附近语法不正确

Question

//2nd - Setup SQL Command
    SqlCommand cmd = new SqlCommand("SELECT [IDTip], [Date], CONVERT(nvarchar(100),[Date], 1) AS Released, [Title], [Image], REPLACE(CONVERT (nvarchar(MAX),[Tip]), '</p>\r\n\r\n<p>', '<p></p>') AS ContentConverted, Recognition, FROM tips WHERE IDTip =" + Request.QueryString["IDTip"], new SqlConnection(HealthReachConString));

//3rd - Attempt to open the connection to the DB
    cmd.Connection.Open();

//4th - Go and fetch some data and apply it to our controls
    SqlDataReader objReader = cmd.ExecuteReader();
    while (objReader.Read())
    {
        lblDate.Text = objReader.GetString(2);
        lblTitle.Text = objReader.GetString(4);
        lblTip.Text = Convert.ToString(objReader["ContentConverted"]);
        imgContentPicture.ImageUrl = "~/files/Health_Tips/" + objReader.GetString(5);
        if (objReader.GetString(5) == " " || objReader.GetString(5) == "")
        {
            imgContentPicture.Visible = false;
        }
        else
        {
            imgContentPicture.Visible = true;
        }

    }
    objReader.Close();
    cmd.Connection.Close();

堆栈跟踪：

[SqlException(0x80131904):关键字“from”附近语法不正确。]
System.Data.sqlclient.sqlConnection.onerror（SqlException exception,Boolean breakConnection,Action`1 wrapCloseInAction)+1791910
System.Data.sqlClient.SqlInternalConnection.onerror（SqlException,Boolean breakConnection,Action`1 wrapCloseInAction)+5347106 tdsparser.tryrun（RunBehavior RunBehavior,SqlCommand cmdHandler,SqlDataReader dataStream,BulkCopySimpleResultSet bulkCopyHandler,TdSparSerStateObj、Boolean&dataReady）+1693
System.data.sqlClient.SqlDataReader.tryConsumemetadata()+61
System.data.sqlClient.SqlDataReader.get_metadata()+90 sqlcommanD.runExecuteReaderTDS(CommandBehavior cmdBehavior,RunBehavior RunBehavior,Boolean returnStream,Boolean async,Int32超时,task&task,Boolean async,Boolean async,Boolean async,SqlDataReader ds)+1421
System.data.sqlclient.sqlCommand.RunExecuteReader（CommandBehavior cmdBehavior RunBehavior RunBehavior RunBehavior.data.sqlclient.sqlcommand.executeReader（CommandBehavior行为，字符串方法）+137
system.data.sqlclient.sqlcommand.executeReader()+99
pressroom_detail.page_load（对象发送者，事件Args e）中的e:\web\healthreach\htdocs\tips_detail.aspx.cs:25
system.web.util.CallieventHandlerdelegateProxy.callback（对象发送者，事件Args ecursive()+54
system.web.ui.page.ProcessRequestMain（Boolean includeStagesBeforeAsyncPoint,Boolean includeStagesAfterAsyncPoint）+772

你知道怎么回事吗？

Answer 1

为了澄清您的问题，额外的逗号向SQL指示存在另一个参数，但是您的参数是您的from。一旦从中删除前的逗号，您的语法就应该有效。假设您已经为convert和alias函数指明了正确的语法。

我还想指出您的查询容易出现SQL注入。要解决这一部分，您应该做以下工作：

SELECT [IDTip], [Date], 
CONVERT(nvarchar(100),[Date], 1) AS Released, [Title], [Image], 
REPLACE(CONVERT (nvarchar(MAX),[Tip]), '</p>\r\n\r\n<p>', '<p></p>') AS [ContentConverted], [Recognition]
FROM [Tips]
WHERE ([IDTip] = @Id);

这就是我在评论中看到的查询错误。