2014-05-11 158 views
0

我想基本的数据库插入这个代码是啥子我在Visual Studio正在运行2010: -抛出异常:连接属性尚未初始化

protected void Button1_Click(object sender, EventArgs e) 
{ 
    SqlConnection conn = new SqlConnection(); 
    conn.ConnectionString="Data Source=.\\SQLEXPRESS;AttachDbFilename=C:\\Users\\Administrator\\Documents\\Visual Studio 2010\\WebSites\\WebSite3\\App_Data\\name.mdf;Integrated Security=True;User Instance=True"; 

    SqlCommand cmd = new SqlCommand("insert into names values('" + TextBox1.Text + "')"); 
    conn.Open(); 
    cmd.ExecuteNonQuery(); 
    conn.Close(); 

} 

我在哪里错了?

+0

您没有添加连接给SqlCommand - '的SqlCommand CMD =新的SqlCommand(“插入名称VALUES('” + TextBox1.Text +“' )“,conn);'或'cmd.Connection = conn;'。另外,学习参数化查询以防止SQL注入攻击。 – Tim

回答

0

您没有指定connection to the command object。请尝试:

protected void Button1_Click(object sender, EventArgs e) 
{ 
    SqlConnection conn = new SqlConnection(); 
    conn.ConnectionString="Data Source=.\\SQLEXPRESS;AttachDbFilename=C:\\Users\\Administrator\\Documents\\Visual Studio 2010\\WebSites\\WebSite3\\App_Data\\name.mdf;Integrated Security=True;User Instance=True"; 

    SqlCommand cmd = new SqlCommand("insert into names values('" + TextBox1.Text + "')"); 
    cmd.Connection = conn; // <- this is the missing line 
    conn.Open(); 
    cmd.ExecuteNonQuery(); 
    conn.Close(); 

} 
1

您创建了一个连接并将其打开,但未将其与SqlCommand关联。您可以通过几种方法执行此操作,无论是在SqlCommand的构造函数中还是通过SqlCommandConnection属性。

此外,您应该使用参数化查询来防止SQL注入攻击。我还建议将SqlConnection放在使用区块中,以确保它关闭并妥善处理。把所有的一起为您提供了这样的事情:

protected void Button1_Click(object sender, EventArgs e) 
{ 

    using (SqlConnection conn = new SqlConnection("Data Source=.\\SQLEXPRESS;AttachDbFilename=C:\\Users\\Administrator\\Documents\\Visual Studio 2010\\WebSites\\WebSite3\\App_Data\\name.mdf;Integrated Security=True;User Instance=True")) 
    { 
     conn.Open(); 
     SqlCommand cmd = new SqlCommand("insert into names values(@name)", conn); 
     // Alternatively, you could do cmd.Connection = conn if you didn't pass 
     // the connection object into the SqlCommand constructor 
     cmd.Parameters.AddWithValue("@name", TextBox1.Text); 

     cmd.ExecuteNonQuery(); 
    } 
} 
相关问题