C＃和SQL Server 2005连接

我有一个窗体，其中我有一个组合框填充表的列名我有一个文本框，我打算输入值，当我点击保存按钮时我想要的数据插入到已经选择的各个列中。C＃和SQL Server 2005连接

这是我的代码。

private void button1_Click(object sender, EventArgs e) 
{ 
    try 
    { 
     myConnection.ConnectionString = "Data Source = AmiayaEjay-Vaio; Initial Catalog = RealTime; User ID = sa; Password = admin"; 

     String combo1 = comboBox1.SelectedItem.ToString(); 
     String combo2 = comboBox2.SelectedItem.ToString(); 
     String combo3 = comboBox3.SelectedItem.ToString(); 
     String combo4 = comboBox4.SelectedItem.ToString(); 
     String combo5 = comboBox5.SelectedItem.ToString(); 
     String combo6 = comboBox6.SelectedItem.ToString(); 
     String combo7 = comboBox7.SelectedItem.ToString(); 
     String combo8 = comboBox8.SelectedItem.ToString(); 

     query1.CommandText = "insert into dbo.DepthTable ('" + combo1 + "','" + combo2 + "','" + combo3 + "','" + combo4 + "','" + combo5 + "','" + combo6 + "' ,'" + combo7 + "','" + combo8 + "') values ('" + textBox1.Text + "','" + textBox2.Text + "','" + textBox3.Text + "','" + textBox4.Text + "','" + textBox5.Text + "','" + textBox6.Text + "','" + textBox7.Text + "','" + textBox8.Text + "')"; 

     query1.CommandType = CommandType.Text; 
     query1.Connection = myConnection; 

     myConnection.Open(); 
     query1.ExecuteNonQuery(); 
    } 
    catch (Exception ex) 
    { 
     throw ex; 
    } 

    myConnection.Close(); 
}

我不断获取我有无效的列名的错误消息，因为SQL命令不能看到COMBO1-combo8有一个有效的列名

来源

2012-07-17 Amiaya EJay

您确定来自组合框的文本有有效的列名吗？也许尝试在查询中将方括号中的列名称包装起来？ – Ken 2012-07-17 15:35:28

请做一些关于SQL注入攻击的研究！ – 2012-07-17 15:36:23

您不需要列列表中的单引号，也可以在字符串变量中创建字符串以查看该值是什么，然后根据数据库架构验证该字符串... var query =“insert .... 。“ query1.CommandText = query; – christiandev 2012-07-17 15:54:53

去掉“'”在COMBOX迹象。

"insert into dbo.DepthTable (" + combo1 + "," + combo2 + "," + combo3 + "," + combo4 + "," + combo5 + "," + combo6 + "," + combo7 + "," + combo8 + ") values ('" + textBox1.Text + "','" + textBox2.Text + "','" + textBox3.Text + "','" + textBox4.Text + "','" + textBox5.Text + "','" + textBox6.Text + "','" + textBox7.Text + "','" + textBox8.Text + "')";

来源

2012-07-17 15:35:58

我试过这样做，但是查询没有看到combo1的值为combo8为列名，所以插入失败 – 2012-07-17 15:51:17

你怎么知道的？也许列名是不正确的。尝试调试并提取查询文本并在sql server management studio中运行它。有错误吗？ – 2012-07-17 15:58:49

@Amiran我不能查询SQL服务器上的脚本，因为它是一个窗口窗体，我已经输入组合框和文本框，我试图使用try和catch异常来调试 – 2012-07-17 16:10:42

C＃和SQL Server 2005连接

回答

相关问题