我无法执行的SqlCommand

Question

好家伙我有这个代码

cmd = new SqlCommand(); 
cmd.Connection = baglanti; 

cmd.CommandText = "(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) VALUES('" + txtMusteriAdi.Text.Trim() + "','" + txtMusteriSoyadi.Text.Trim() + "','" + txtGsm.Text.Trim() + "','" +txtEmail.Text.Trim() + "','" +txtSirketAdi.Text.Trim() + "','" +txtAdres.Text.Trim() + "','" +txtNotlar.Text.Trim() +"');"; 
baglanti.Open(); 
cmd.ExecuteNonQuery(); 

baglanti.Close(); 

我所定义的CMD为public SqlCommmand，并在每一次当代码来它属于赶上我能做些什么的cmd.ExecuteNonQuery() 。

Answer 1

因为您忘记了INSERT INTO部分供您发言。喜欢;

INSERT INTO tableName(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) 

但更重要的是，你应该总是使用parameterized queries。这种字符串连接对于SQL Injection攻击是开放的。

还可以使用using statement处置你的连接，并自动指挥代替手动调用Close方法。

using(var baglanti = new SqlConnnection(yourConnectionString)) 
using(var cmd = baglanti.CreateCommand()) 
{ 
    cmd.CommandText = @"INSERT INTO tableName(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) 
         VALUES(@ad, @soyad, @gsm, @email, @sirket, @adres, @notlar)"; 
    // Add your parameters values with Add method considering their types and size. 
    baglanti.Open(); 
    cmd.ExecuteNonQuery(); 
}