OleDbException：INSERT INTO语句中的语法错误

Question

我得到OleDbException：INSERT INTO语句中的语法错误。我认为我的INSERT INTO声明很好。参数具有良好的数据类型，所以它没有问题。有人可能知道有什么问题吗？

 OleDbCommand command = new OleDbCommand(); 
     command.Connection = conn; 
     command.CommandType = CommandType.Text; 
     command.CommandText = String.Format("INSERT INTO Employees" + 
      " (ID, Company, Last Name, First Name, E-mail Address, Job Title, Business Phone, Home Phone" + 
      ", Mobile Phone, Fax NUmber, Address, City, State/Province, ZIP/Postal Code, Country/Region, Web Page, Notes)" + 
      " Values ('{0}', '{1}','{2}','{3}','{4}','{5}'," + 
      "'{6}','{7}','{8}','{9}','{10}','{11}','{12}','{13}','{14}','{15}','{16}')", iD,kompanija,prezime,ime,email, 
      zvanje,busTelefon,telefon,mobTelefon,fax,adresa,grad,okrug,postanskiBroj,zemlja,web,beleska);    zvanje,busTelefon,telefon,mobTelefon,fax,adresa,grad,okrug,postanskiBroj,zemlja,web,beleska); 

     conn.Open(); 
     command.ExecuteNonQuery(); 
     conn.Close(); 

错误消息：

UDATE SQL：

 OleDbCommand command = new OleDbCommand(); 
     command.Connection = conn; 
     command.CommandType = CommandType.Text; 
     string cmdText = String.Format(@"UPDATE TABLE Employees " + 
         "SET" + 
         " Company='" + kompanija + "'," + 
         " [Last Name]='" + prezime + "'," + 
         " [First Name]='" + ime + "'," + 
         " [E-mail Address]='" + email + "' ," + 
         " [Job Title]='" + zvanje +"'," + 
         " [Business Phone]='" + busTelefon + "'," + 
         " [Home Phone]='" + telefon + "'," + 
         " [Mobile Phone]='" + mobTelefon + "'," + 
         " [Fax Number]='" + fax + "'," + 
         " Address='" + adresa + "'," + 
         " City='" + grad + "'," + 
         " [State/Province]='" + okrug + "'," + 
         " [ZIP/Postal Code]='" + postanskiBroj + "'," + 
         " [Country/Region]='" + zemlja + "'," + 
         " [Web Page]='" + web + "'," + 
         " Notes='" + beleska + "' WHERE ID="+iD); 
     command.CommandText = cmdText; 

     conn.Open(); 
     command.ExecuteNonQuery(); 
     conn.Close(); 

而这个SQL不起作用。像以前一样的错误。

Answer 1

当你的领域名称包含空格或其他字符误区，如/（除法运算符），你需要他们被封闭在方括号

string cmdText = @"INSERT INTO Employees 
        (ID, Company, [Last Name], [First Name], [E-mail Address], 
        .., [State/Province], ....) VALUES (....)"; 

而且你是不是在你的查询中使用的参数。 String.Format只是另一种字符串连接类型，无法通过无效输入保护您（例如，尝试在您的姓氏值中使用单引号），并且无法从Sql Injection vulnerability保存您的代码。

你应该总是使用参数化查询

string cmdText = @"INSERT INTO Employees (your_field_list_comma_sep) 
        VALUES (@id, @company, @lastname, @firstname, 
        ......)"; 

OleDbCommand cmd = new OleDbCommand(cmdText, conn); 
cmd.Parameters.Add("@id", OleDbType.Integer).Value = iD; 
cmd.Parameters.Add("@company", OleDbType.VarWChar).Value = kompanija; 
cmd.Parameters.Add("@lastname", OleDbType.VarWChar).Value = prezime; 
cmd.Parameters.Add("@firstname", OleDbType.VarWChar).Value = ime; 
.... 
// add all the other parameters with their name and type 
.... 
cmd.ExecuteNonQuery();