且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

SQL数据库插入问题

更新时间:2023-02-08 18:48:47

问题是您需要在Type值的两边加上单引号.由于SQL注入和其他问题,在使用SQL时不赞成使用字符串连接.您应该养成使用参数化查询的习惯.

The problem is that you need to have single quotes around the value for Type. Using string concatenation is frowned upon when working with SQL because of SQL injection and other issues. You should get in the habit of using parameterized queries.

string cmd = "INSERT INTO Log(Type, Rego) VALUES('" + typeBox.Text + "'," + regoBox.Text + ")";



参数化查询版本.



Parameterized Query Version.

SqlCeConnection conn = new SqlCeConnection(connStr);
conn.Open();
 
string cmd = "INSERT INTO Log(Type, Rego) VALUES(@Type, @Rego)";
 
SqlCeCommand writeToDB = new SqlCeCommand(cmd, conn);
writeToDB.Parameters.Add(new SqlCeParameter("@Type", typeBox.Text);
writeToDB.Parameters.Add(new SqlCeParameter("@Rego", regoBox.Text);
writeToDB.ExecuteNonQuery();
conn.Close();


您忘了用''(单引号)将类型列的值括起来.另外,请注意,这不是编写查询的好方法.在将值放入SqlCommand时使用参数.请参见此处 [
You forgot to enclose the value of the type column with ''(Single Quotes). Also, please note that this is not a good way to write queries. Use parameters in putting values to your SqlCommand. See here[^] for reference.


您做了一件大事.

you have done one mistak.

string cmd = "INSERT INTO Log(Type,Rego) VALUES('" + typeBox.Text + "'," + regoBox.Text + ")";



将此行放入您的代码中.



put this line into ur code.