使用ado.net通过C＃将值插入SQL Server数据库
我创建了一个简单的程序来将值插入表[regist] ，但我一直收到错误
‘）附近的语法不正确
on cmd.ExecuteNonQuery(); ：
private void button1_Click(object sender, EventArgs e) { SqlConnection cn = new SqlConnection("Data Source=DELL-PC;initial catalog=AdventureWorks2008R2 ; User ID=sa;Password=sqlpass;Integrated Security=SSPI;"); SqlCommand cmd = new SqlCommand("INSERT INTO dbo.regist (" + " FirstName, Lastname, Username, Password, Age, Gender,Contact, " + ") VALUES (" + " @textBox1.Text, @textBox2.Text, @textBox3.Text, @textBox4.Text, @comboBox1.Text,@comboBox2.Text,@textBox7.Text" + ")", cn); cn.Open(); cmd.ExecuteNonQuery(); cn.Close(); }
我是新手，我真的很困惑。
正如我在评论中所说 – 你应该总是在查询中使用参数 – 永远不要自己将SQL语句连接在一起。
另外：我建议将click事件处理程序与实际代码分开以插入数据。
所以我会重写你的代码
在您的网页的代码隐藏文件（ yourpage.aspx.cs ）中
private void button1_Click(object sender, EventArgs e) { string connectionString = "Data Source=DELL-PC;initial catalog=AdventureWorks2008R2 ; User ID=sa;Password=sqlpass;Integrated Security=SSPI;"; InsertData(connectionString, textBox1.Text.Trim(), -- first name textBox2.Text.Trim(), -- last name textBox3.Text.Trim(), -- user name textBox4.Text.Trim(), -- password Convert.ToInt32(comboBox1.Text), -- age comboBox2.Text.Trim(), -- gender textBox7.Text.Trim() ); -- contact }
在其他一些代码中（例如databaselayer.cs ）：
private void InsertData(string connectionString, string firstName, string lastname, string username, string password int Age, string gender, string contact) { // define INSERT query with parameters string query = "INSERT INTO dbo.regist (FirstName, Lastname, Username, Password, Age, Gender,Contact) " + "VALUES (@FirstName, @Lastname, @Username, @Password, @Age, @Gender, @Contact) "; // create connection and command using(SqlConnection cn = new SqlConnection(connectionString)) using(SqlCommand cmd = new SqlCommand(query, cn)) { // define parameters and their values cmd.Parameters.Add("@FirstName", SqlDbType.VarChar, 50).Value = firstName; cmd.Parameters.Add("@Lastname", SqlDbType.VarChar, 50).Value = lastName; cmd.Parameters.Add("@Username", SqlDbType.VarChar, 50).Value = userName; cmd.Parameters.Add("@Password", SqlDbType.VarChar, 50).Value = password; cmd.Parameters.Add("@Age", SqlDbType.Int).Value = age; cmd.Parameters.Add("@Gender", SqlDbType.VarChar, 50).Value = gender; cmd.Parameters.Add("@Contact", SqlDbType.VarChar, 50).Value = contact; // open connection, execute INSERT, close connection cn.Open(); cmd.ExecuteNonQuery(); cn.Close(); } }
像这样的代码：
- 不容易受到SQL注入攻击
- 在SQL Server上执行得更好（因为查询被解析为执行计划一次，然后缓存并在以后重用）
- 将事件处理程序（代码隐藏文件）与您的实际数据库代码分开（将它们放在它们所属的位置 – 帮助避免使用大量意大利面条代码“超重”代码隐藏，执行从处理UI事件到数据库访问的所有操作 – 不是很好设计！）
删除逗号
... Gender,Contact, " + ") VALUES ... ^-----------------here
以下代码适用于“ 通过C＃使用ado.net将值插入SQL Server数据库 ”
// Your Connection string string connectionString = "Data Source=DELL-PC;initial catalog=AdventureWorks2008R2 ; User ID=sa;Password=sqlpass;Integrated Security=SSPI;"; // Collecting Values string firstName="Name", lastName="LastName", userName="UserName", password="123", gender="Male", contact="Contact"; int age=26; // Query to be executed string query = "Insert Into dbo.regist (FirstName, Lastname, Username, Password, Age, Gender,Contact) " + "VALUES (@FN, @LN, @UN, @Pass, @Age, @Gender, @Contact) "; // instance connection and command using(SqlConnection cn = new SqlConnection(connectionString)) using(SqlCommand cmd = new SqlCommand(query, cn)) { // add parameters and their values cmd.Parameters.Add("@FN", System.Data.SqlDbType.NVarChar, 100).Value = firstName; cmd.Parameters.Add("@LN", System.Data.SqlDbType.NVarChar, 100).Value = lastName; cmd.Parameters.Add("@UN", System.Data.SqlDbType.NVarChar, 100).Value = userName; cmd.Parameters.Add("@Pass", System.Data.SqlDbType.NVarChar, 100).Value = password; cmd.Parameters.Add("@Age", System.Data.SqlDbType.Int).Value = age; cmd.Parameters.Add("@Gender", System.Data.SqlDbType.NVarChar, 100).Value = gender; cmd.Parameters.Add("@Contact", System.Data.SqlDbType.NVarChar, 100).Value = contact; // open connection, execute command and close connection cn.Open(); cmd.ExecuteNonQuery(); cn.Close(); }
private void button1_Click(object sender, EventArgs e) { SqlConnection con = new SqlConnection(); con.ConnectionString = "data source=CHANCHAL\SQLEXPRESS;initial catalog=AssetManager;user id=GIPL-PC\GIPL;password="; con.Open(); SqlDataAdapter ad = new SqlDataAdapter("select * from detail1", con); SqlCommandBuilder cmdbl = new SqlCommandBuilder(ad); DataSet ds = new DataSet("detail1"); ad.Fill(ds, "detail1"); DataRow row = ds.Tables["detail1"].NewRow(); row["Name"] = textBox1.Text; row["address"] =textBox2.Text; ds.Tables["detail1"].Rows.Add(row); ad.Update(ds, "detail1"); con.Close(); MessageBox.Show("insert secussfully"); }
你应该删除最后一个逗号，并且nrodic表示你的命令不正确。
你应该改变它：
SqlCommand cmd = new SqlCommand("INSERT INTO dbo.regist (" + " FirstName, Lastname, Username, Password, Age, Gender,Contact " + ") VALUES (" + " textBox1.Text, textBox2.Text, textBox3.Text, textBox4.Text, comboBox1.Text,comboBox2.Text,textBox7.Text" + ")", cn);