首先我尝试使用以下代码

strQuery = @"SELECT PASSWORD FROM IBK_USERS where upper(user_id) =upper('" + UserPrefix + "')";

try
{
    ocommand = new OracleCommand();
    if (db.GetConnection().State == ConnectionState.Open)
    {
        ocommand.CommandText = strQuery;
        ocommand.Connection = db.GetConnection();                       
        odatareader = ocommand.ExecuteReader();
        odatareader.Read();

最后我转换了上面的查询以防止像这样的SQL注入

strQuery = @"SELECT PASSWORD FROM IBK_USERS where upper(user_id) =upper(:UserPrefix)";
try
{
    ocommand = new OracleCommand();
    if (db.GetConnection().State == ConnectionState.Open)
    {
        ocommand.CommandText = strQuery;
        ocommand.Connection = db.GetConnection();

        ocommand.Parameters.Add(":UserPrefix",OracleDbType.Varchar2,ParameterDirection.Input);
        ocommand.Parameters[":UserPrefix"].Value = UserPrefix;
        odatareader = ocommand.ExecuteReader();

但这不起作用