且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

使数据插入数据库而不是returni

更新时间:2023-02-02 23:33:00

首先做两件事:

1)不要连接字符串以构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度,这可能会破坏您的整个数据库。请改用参数化查询。

2)停止吞咽异常并记录它们,以便您了解错误实际是什么。只需使用一个catch块来设置错误,因为返回字符串会抛弃您需要的所有信息,以便首先找出错误发生的原因!



所以修复查询 - 这是绝对的优先级,除非你喜欢通过输入表单来删除数据库 - 并更改catch块:

Start by doing two things:
1) Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
2) Stop swallowing exceptions and log them so that you have some idea of what the error actually was. Just using a catch block to set "error" as the return string throws away all the information you needed to have to work out why the error occurred in the first place!

So fix the queries - that is an absolute priority, unless you like people deleting your database by typing in your form - and change the catch block:
catch (Exception ex)
    {
    result = "error";
    Debug.WriteLine(ex.Message);
    }

然后在Debug.WriteLine行上放置一个断点,看看调试器点击它时会得到什么。

Then put a breakpoint on the Debug.WriteLine line and see what you get when the debugger hits it.