2015-06-14 65 views
1

我正在试验数据库,我找到了不同的方法来优化我的代码。在这里,我正在使用不同的类来停止重新编写相同的代码,例如添加,删除和更新,我们使用相同的ExecuteNonQuery()方法。到目前为止,更新删除方法运行良好,除了插入。编译器不会给出任何错误,但是从文本框中获取的值不会转到变量字符串查询。我是新来的C#编码。谁能帮我?或建议?如何将数据插入数据库? - 用户定义的类

using DBconnectionExercise.DBConnection_Components; 
namespace DBconnectionExercise 
{ 
    public partial class Student_Form : Form 
    { 
     DBComps dc = new DBComps(); 

     //public string constring; 
     //public SqlConnection con = null; 
     //public SqlCommand com = null; 
     public String query; 

     public Student_Form() 
     { 
      InitializeComponent(); 

      //constring = "Data Source=ASHANE-PC\\ASHANESQL;Initial Catalog=SchoolDB;Integrated Security=True"; 
      //con = new SqlConnection(constring); 

      dc.ConnectDB(); 


     } 

     private void Form1_Load(object sender, EventArgs e) 
     { 

      loadGridData(); 

     } 
     private void dtp_dob_ValueChanged(object sender, EventArgs e) 
     { 
      DateTime Now = DateTime.Today; 
      DateTime Dob = dtp_dob.Value.Date; 
      int a = Now.Year - Dob.Year; 
      if (Now < Dob.AddYears(a)) a--; 
      tb_Age.Text = a.ToString(); 
     } 

     private void loadGridData() 
     { 
      try 
      { 
       query = "Select * from tb_Student"; 
       //dc.OpenCon(); 
       //SqlDataAdapter da = new SqlDataAdapter(query, con); 
       DataTable dt1 = new DataTable(); 
       dt1 = dc.Data_Table(query); 
       //da.Fill(dt); 
       Stu_DataGrid.DataSource = dt1; 
       //con.Close(); 

      } 
      catch (Exception ex) 
      { 
       MessageBox.Show(ex.ToString()); 
      } 
     } 

     private void ClearData() 
     { 
      tb_Name.Clear(); 
      tb_Address.Clear(); 
      tb_Telno.Clear(); 
      tb_Search.Clear(); 
      tb_Age.Clear(); 
      dtp_dob.Value = DateTime.Today; 

     } 

     private void btn_Add_Click(object sender, EventArgs e) 
     { 
      try 
      { 
       String name = tb_Name.Text; 
       DateTime dob = dtp_dob.Value.Date; 
       int age = Convert.ToInt32(tb_Age.Text); 
       String Address = tb_Address.Text; 
       int telno = Convert.ToInt32(tb_Telno.Text); 
       int line = 0; 


       //con.Open(); 
       query = "Insert into tb_Student values(@Stu_Name, @Stu_DOB, @Age, @Stu_Address, @Stu_Tel_no)"; 
       //query = "Insert into tb_Student (Stu_Name, Stu_DOB, Age, Stu_Address, Stu_Tel_no) Values('" + name + "','" + dob + "','" + age + "','" + Address + "','" + telno + "')"; 
       MessageBox.Show(query); 
       //com = new SqlCommand(query, con); 

       // This is the Insert/save code 

       DBComps.com.Parameters.AddWithValue("@Stu_Name", name); 
       DBComps.com.Parameters.AddWithValue("@Stu_DOB", dob); 
       DBComps.com.Parameters.AddWithValue("@Age", age); 
       DBComps.com.Parameters.AddWithValue("@Stu_Address", Address); 
       DBComps.com.Parameters.AddWithValue("@Stu_Tel_no", telno); 

       //line = com.ExecuteNonQuery(); 
       line = dc.ExeNonQuery(query); 
       //com.Dispose(); 
       //con.Close(); 

       if (line > 0) 
       { 
        loadGridData(); 
        ClearData(); 
        MessageBox.Show("Data saved sucessfully!", "Data Saved", MessageBoxButtons.OK, MessageBoxIcon.Information); 
       } 
       else 
        MessageBox.Show("Data not Saved", "Error Save", MessageBoxButtons.OK, MessageBoxIcon.Error); 
      } 
      catch(Exception ex) 
      { 
       MessageBox.Show(ex.ToString()); 
      } 
     } 

这是DBComps类以前写SQL函数的方法。

namespace DBconnectionExercise.DBConnection_Components 
    { 
     public class DBComps 
     { 
      public String conSring; 
      public SqlConnection con = null; 
      public static SqlCommand com = null; 

      public void ConnectDB() 
      { 
       conSring = "Data Source=ASHANE-PC\\ASHANESQL;Initial Catalog=SchoolDB;Integrated Security=True"; 
       con = new SqlConnection(conSring); 
      } 

      public void OpenCon() 
      { 
       con.Open(); 
      } 

      public void CloseCon() 
      { 
       con.Close(); 
      } 

      public int ExeNonQuery(String query) //the method for Insert, update and delete. 
      { 

       int line = 0; 
       OpenCon(); 
       com = new SqlCommand(query, con); 
       line = com.ExecuteNonQuery(); 
       com.Dispose(); 
       CloseCon(); 

       return line; 
      } 
    } 
} 
+0

每次调用'dc.ExeNonQuery'时,都会创建一个新的命令实例'com = new SqlCommand(query,con);',从而失去了之前添加到以前'com'值的所有参数。最简单的解决方案是每次停止创建新的命令实例,通过设置[命令文本属性](https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.com和text (v = vs.110).aspx)的现有命令(!!!它可以是空的第一次!!!)。 –

+0

P.S .:当实例方法和静态字段不是实际需要时混合使用它是一个坏主意。此外,[使用](https://msdn.microsoft.com/en-us/library/yh598w02.aspx)声明可能会对您感兴趣。 –

+0

@EugenePodskal是的,我真的很傻。我删除了所有这些,最后我找到了答案。谢谢您的帮助。 –

回答

1

好吧,终于我想出了我的问题的答案,因为我的预期。在这里如何做到这一点;

private void btn_Add_Click(object sender, EventArgs e) 
     { 
      try 
      { 
       String name = tb_Name.Text; 
       DateTime dob = dtp_dob.Value.Date; 
       int age = Convert.ToInt32(tb_Age.Text); 
       String Address = tb_Address.Text; 
       int telno = Convert.ToInt32(tb_Telno.Text); 
       int line = 0; 


       query = "Insert into tb_Student values('"+ name +"','"+ dob +"','"+ age +"','"+ Address +"','"+ telno +"')"; 

       MessageBox.Show(query); //To see it works! 

       line = dc.ExeNonQuery(query); 

       if (line > 0) 
       { 
        loadGridData(); 
        ClearData(); 
        MessageBox.Show("Data saved sucessfully!", "Data Saved", MessageBoxButtons.OK, MessageBoxIcon.Information); 
       } 
       else 
        MessageBox.Show("Data not Saved", "Error Save", MessageBoxButtons.OK, MessageBoxIcon.Error); 
      } 
      catch(Exception ex) 
      { 
       MessageBox.Show(ex.ToString()); 
      } 
     } 

一定要记得写查询语句的变量/值,以便与表头一致。否则会产生错误。感谢大家帮助解决这个问题! :-)

+0

最好的使用方法是使用参数! –

2

这是交谈的数据库非常非常糟糕的方式,它被破解利用SQL注入和因为你正在学习,它的合适的时间来指出这一点:

query = "Insert into tb_Student values('"+ name +"','"+ dob +"','"+ age +"','"+ Address +"','"+ telno +"')"; 

SQL注入为已读了为什么以及如何,寻找最佳实践以找出更好的方法。

+0

OK @mladen已经在上面了。谢谢。 –

+0

现在我看到我处于极度危险之中。我应该使用这个问题的参数。还修复了日期时间选择器中恼人的错误。哇,谢谢你让我知道SQL注入。 –