SQL更新命令不起作用

Question

我在Asp.net网站上创建了一个网页。接下来的页面加载将从上一页获取参数时运行。该页面还具有编辑数据库内容和更新的选项。但是，当按钮（保存）被点击时，它不会更新数据库。很好的帮助。但是，当页面加载中没有连接时，更新命令将起作用。

protected void Page_Load(object sender, EventArgs e) 
{ 
    String cust=Request.QueryString["custName"]; 
    String env = Request.QueryString["env"]; 
    SqlConnection cnn = new SqlConnection(); 
    string connStr = ConfigurationManager.ConnectionStrings["cnn"].ConnectionString; 
    SqlDataAdapter adapter = new SqlDataAdapter(); 
    cnn.ConnectionString = connStr; 
    cnn.Open(); 
    view(); 
    if (env == "Production") 
    { 
     DataSet MyDataSet = new DataSet(); 
     adapter = new SqlDataAdapter("Select * from Customer_Production where Customer_Name=@cust", cnn); 
     SqlCommandBuilder m_cbCommandBuilder = new SqlCommandBuilder(adapter); 
     cnn.Close(); 
     //SqlCommand cmd = new SqlCommand("Select * from Customer_Production where Customer_Name=@cust", cnn); 
     adapter.SelectCommand.Parameters.AddWithValue("@cust", cust); 
     adapter.Fill(MyDataSet, "Servers"); 
     foreach (DataRow myRow in MyDataSet.Tables[0].Rows) 
     { 
      custName.Value = myRow["Customer_name"].ToString(); 
      custMaintain.Value= myRow["Customer_Maintenance"].ToString(); 
      serviceAffect.Value=myRow["Systems/Services_Affected"].ToString(); 
      email_Content.Value= myRow["Email_Content"].ToString(); 
      email_Signature.Value= myRow["Email_Signature"].ToString(); 
      email_From.Value=myRow["Email_From"].ToString(); 
      email_To.Value=myRow["Email_To"].ToString(); 
      email_Cc.Value=myRow["Email_Cc"].ToString(); 
      email_Bcc.Value=myRow["Email_Bcc"].ToString(); 

     } 
    } 
    else 
    { 
     DataSet MyDataSet = new DataSet(); 
     adapter = new SqlDataAdapter("Select * from Customer_Non_Production where Customer_Name=@cust", cnn); 
     SqlCommandBuilder m_cbCommandBuilder = new SqlCommandBuilder(adapter); 
     cnn.Close(); 
     //SqlCommand cmd = new SqlCommand("Select * from Customer_Production where Customer_Name=@cust", cnn); 
     adapter.SelectCommand.Parameters.AddWithValue("@cust", cust); 
     adapter.Fill(MyDataSet, "Servers"); 


     foreach (DataRow myRow in MyDataSet.Tables[0].Rows) 
     { 
      custName.Value = myRow["Customer_name"].ToString(); 
      custMaintain.Value = myRow["Customer_Maintenance"].ToString(); 
      serviceAffect.Value = myRow["Systems/Services_Affected"].ToString(); 

      email_Content.Value = myRow["Email_Content"].ToString(); 
      email_Signature.Value = myRow["Email_Signature"].ToString(); 
      email_From.Value = myRow["Email_From"].ToString(); 
      email_To.Value = myRow["Email_To"].ToString(); 
      email_Cc.Value = myRow["Email_Cc"].ToString(); 
      email_Bcc.Value = myRow["Email_Bcc"].ToString(); 

     } 
    } 

以下是保存按钮按一下按钮（FOR UPDATE命令）

protected void save_click(object sender, EventArgs e) 
{ 
    //Button Click Save 
    /*  String id = "A"; 
    SqlConnection cnn = new SqlConnection(); 
    string connStr = ConfigurationManager.ConnectionStrings["cnn"].ConnectionString; 
    SqlDataAdapter adapter = new SqlDataAdapter(); 
    cnn.ConnectionString = connStr; 
    cnn.Open(); 
    String sql = String.Format("Update Customer_Production set Email_Signature='{0}' where Customer_Name like '{1}'",TextBox1.Text,id); 
    SqlCommand cmd = new SqlCommand(sql, cnn); 

    cmd.ExecuteNonQuery(); 
    */ 
    String cust = "A"; 
    SqlConnection cnn = new SqlConnection(); 
    string connStr = ConfigurationManager.ConnectionStrings["cnn"].ConnectionString; 
    SqlDataAdapter adapter = new SqlDataAdapter(); 
    cnn.ConnectionString = connStr; 
    cnn.Open(); 
    if (env.Value == "Production") 
    { 
     //String sql = String.Format("Update Customer_Production set Customer_Maintenance='{0}',Environment='{1}',[Systems/Services_Affected]='{2}',Email_Content='{3}',Email_Signature='{4}',Email_To='{5}',Email_Cc='{6}',Email_Bcc='{7}',Email_From='{8}' where Customer_Name like '{9}' ", "custMaintain.Value","env.Value","serviceAffect.Value","email_Content.Value","email_To.Value","email_Cc.Value","email_Bcc.Value","email_From.Value", "cust"); 
     String sql = String.Format("Update Customer_Production set Email_Signature='{0}' where Customer_Name like '{1}'", email_Signature.Value,cust); 
     SqlCommand cmd = new SqlCommand(sql, cnn); 
     cmd.ExecuteNonQuery(); 

    } 
    else 
    { 

    } 

} 

Answer 1

我不知道为什么在Page_Load具有连接（或不）会有所作为，但这里有一件事看起来关对我说：

String.Format(
    "Update Customer_Production set Email_Signature='{0}' where Customer_Name like '{1}'",   
    email_Signature.Value, 
    cust); 

（我把它弄坏了成几行，因为我很感兴趣的部分是格式字符串的最后一部分）。

您之前在该方法中已将cust设置为“A”。因此，这将导致会看（末）的SQL是这样的：

... where Customer_Name like 'A' 

除非你有一个客户名称恰好等于A，这不会返回任何东西，因此没有记录将被更新。你忘记了'％'通配符。

我同意所有那些指出你的代码容易受到SQL注入攻击（你也会遇到单引号问题），但只是为了告诉你它需要的样子，在这里它是与通配符：

Update Customer_Production set Email_Signature='{0}' where Customer_Name like '{1}%'