我有以下声明：

SELECT [nozzles].[nozzle_tag],[nozzles].[id]
       FROM [dispensers] 
       INNER JOIN [nozzles] 
       ON [dispenser_id] = [dispensers].[id] 
       INNER JOIN (SELECT * FROM assets 
                   WHERE [i4_Device_Name] = 'EH004T_SOURCE2' 
                   AND [i4_site_name] = 'Les Loges - H2e Station (EH004R)')assets
       ON [asset_id] = [assets].[id]
WHERE [dispenser_tag] ='Dispenser 2';

当我在SSMS中执行它时，它工作得非常好。

问题是，当使用SQLcommand运行此SQL时，我收到一条错误消息：

“Loges”附近的语法不正确。

我不明白为什么。

上面的命令是从一个日志文件中提取出来的，它正是使用SQL命令发送的。

C#代码是：

 using (SqlConnection connection = new SqlConnection(connectionString))
            {
                connection.Open();
                using (SqlCommand command = new SqlCommand(HySoSQLCommandBuilder.GetAllNozzleOfDispenser(locationID, dispenserTag), connection))
                {
                    logger.Info("SQL request {request}", HySoSQLCommandBuilder.GetAllNozzleOfDispenser(locationID, dispenserTag));

                    using (SqlDataReader reader = command.ExecuteReader())
                    {
                        try
                        {
                            while (reader.Read())
                                if (reader.HasRows)
                                {
                                    list.Add(new nozzle((string)reader["nozzle_tag"], (int)reader["id"]));
                                }
                        }
                        catch { }
                    }
                }

使用HySoSQLCommandBuilder。GetAllNozzleOfDispenser（）非常直截了当：

public static string GetAllNozzleOfDispenser(AssetLocationID assetLocation, string dispenserTag)
        {
            return $@"SELECT [nozzles].[nozzle_tag],[nozzles].[id]
                        FROM [dispensers] 
                        INNER JOIN [nozzles] 
                            ON [dispenser_id] = [dispensers].[id] 
                        INNER JOIN (SELECT * FROM assets 
                                    WHERE [i4_Device_Name] = '{assetLocation.i4DeviceName}' 
                                    AND [i4_site_name] = '{assetLocation.i4SiteName}')assets
                            ON [asset_id] = [assets].[id]
                       WHERE [dispenser_tag] ='{dispenserTag}';";
        }

从代码外部无法访问任何注入的值。它们不是来自用户可访问的可编辑字段。如果SQL注入发生，那么这意味着它在源代码中，由处理代码的人完成，并且已经可以对数据库做任何他们想做的事情，而不需要对SQL注入进行编码。