VB.NET WinForm中OleDb执行查询报‘无效SQL语句’错误排查

开发VB.NET WinForm应用时，为ComboBox控件编写联动查询逻辑：绑定SelectedIndexChanged和窗体Activated事件，根据选中的CustomerID值，通过OleDb连接查询customer表对应记录，将字段值回填到关联TextBox控件。程序运行时抛出SQL执行异常：

Invalid SQL statement; expected 'DELETE', 'INSERT', 'PROCEDURE', 'SELECT', or 'UPDATE'
异常本质是SQL执行引擎未识别到合法的SQL命令关键字。

Private Sub ComboBox1_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ComboBox1.SelectedIndexChanged, MyBase.Activated
    con.Close()

    con.Open()
    str = "select * from customer where CustomerID='" & ComboBox1.Text & "'"
    cmd = New OleDbCommand(str, con)
    da.SelectCommand = cmd
    If IsNumeric(ComboBox1.Text) Then
        cmd.CommandText = str = "select * from customer where CustomerID=@cid"
        cmd.Prepare()
        cmd.Parameters.AddWithValue("cid", ComboBox1.Text)
        Dim dr As OleDbDataReader = cmd.ExecuteReader()
        Try
            If dr.Read() Then
                TextBox1.Text = dr.GetValue(1)
                TextBox2.Text = dr.GetValue(2)
                TextBox3.Text = dr.GetValue(3)
                TextBox4.Text = dr.GetValue(4)
                TextBox5.Text = dr.GetValue(5)
                dr.Close()
            End If

        Catch ex As Exception
            MsgBox("", ex.Message)
            dr.Close()
        Finally
            con.Close()

        End Try
    End If
End Sub

• 触发异常的根本原因是连续赋值语法错误：VB中cmd.CommandText = str = "查询语句"的实际执行逻辑是，先判断str和右侧字符串是否相等，将返回的布尔结果赋值给cmd.CommandText，导致命令文本为布尔值False，根本不是合法SQL字符串，直接触发SQL解析报错。
• 连接管理逻辑漏洞：事件触发时无论是否满足数字判断的查询条件，都会提前打开数据库连接，当ComboBox文本非数字时，后续的连接关闭逻辑不会执行，会造成连接长期占用，引发后续状态异常。
• 弹窗参数顺序错误：MsgBox("", ex.Message)将异常信息作为弹窗样式参数传入，实际无法展示错误详情，阻碍问题排查。
• 适配规则遗漏：OleDb提供程序仅按参数出现顺序匹配值，不识别参数名称映射，参数顺序错位会直接导致查询结果异常。
• 缺少空值防护：事件同时绑定ComboBox选中变更和窗体激活动作，窗体首次加载、ComboBox未选中有效值时，会触发空值操作异常。

Private Sub ComboBox1_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ComboBox1.SelectedIndexChanged, MyBase.Activated
    ' 空值防护：无有效选中项时直接退出
    If String.IsNullOrWhiteSpace(ComboBox1.Text) OrElse Not IsNumeric(ComboBox1.Text) Then
        Return
    End If

    ' 使用Using块自动释放连接、命令、读取器资源
    Using conn As New OleDbConnection(数据库连接字符串)
        Try
            conn.Open()
            Dim query As String = "SELECT * FROM customer WHERE CustomerID = @cid"
            Using cmd As New OleDbCommand(query, conn)
                ' OleDb按顺序匹配参数，参数顺序需与SQL中占位符顺序保持一致
                cmd.Parameters.AddWithValue("@cid", Convert.ToInt32(ComboBox1.Text))
                Using dr As OleDbDataReader = cmd.ExecuteReader()
                    If dr.Read() Then
                        ' 安全取值，避免数据库空值引发的类型转换异常
                        TextBox1.Text = If(dr.IsDBNull(1), "", dr.GetValue(1).ToString())
                        TextBox2.Text = If(dr.IsDBNull(2), "", dr.GetValue(2).ToString())
                        TextBox3.Text = If(dr.IsDBNull(3), "", dr.GetValue(3).ToString())
                        TextBox4.Text = If(dr.IsDBNull(4), "", dr.GetValue(4).ToString())
                        TextBox5.Text = If(dr.IsDBNull(5), "", dr.GetValue(5).ToString())
                    End If
                End Using
            End Using
        Catch ex As Exception
            ' 修正MsgBox参数顺序，正确展示错误信息
            MsgBox($"查询失败：{ex.Message}", MsgBoxStyle.Error, "操作错误")
        End Try
    End Using
End Sub

内容的提问来源于stack exchange，提问作者Ubaid Rahman