错误的.ExecuteNonQuery（）在SQL更新查询

Question

我试图更新使用SQL查询的Access数据库，每当我点击保存按钮，它会产生一个错误

类型的未处理的异常“ System.Data.OleDb.OleDbException'发生在System.Data.dll中

附加信息：没有给出一个或多个所需参数的值。

并突出显示.ExecuteNonQuery()。你们能帮我解决吗？我是vb.net的新手。

在此先感谢。

Private Sub SaveButton_Click(sender As Object, e As EventArgs) Handles SaveButton.Click 
     Dim empNum As String 
     Dim empFname As String 
     Dim empLname As String 
     Dim empDept As String 
     Dim empStat As String 
     Dim empYears As String 



     empNum = eNumText.Text 
     empFname = empFnameText.Text 
     empLname = empLnameText.Text 
     empDept = DeptText.Text 
     empStat = StatText.Text 
     empYears = yearstext.Text 

     con.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0; Data Source= c:\Databse\Company_db.accdb" 
     con.Open() 

     MsgBox(empNum) 


     Dim SqlAdapter As New OleDbDataAdapter 
     Dim Table As New DataTable 

     Dim sqlQuery As String = "UPDATE tbl_empinfo SET EmpID='" & empNum & "', FirstName ='" & empFname & "', LastName='" & empLname & "', Department='" & empDept & "', Status='" & empStat & "', Years='" & empYears & "' WHERE EmpID ='" & empNum & "' " 


     Using cmd As New OleDbCommand(sqlQuery, con) 
      With cmd 
       .CommandText = sqlQuery 
       .Connection = con 
       .Parameters.AddWithValue("EmpID", empNum) 
       .Parameters.AddWithValue("FirstName", empFname) 
       .Parameters.AddWithValue("LastName", empLname) 
       .Parameters.AddWithValue("Department", empDept) 
       .Parameters.AddWithValue("Status", empStat) 
       .Parameters.AddWithValue("Years", empYears) 
       .ExecuteNonQuery() 
      End With 
     End Using 

     sqlQuery = "SELECT * FROM tbl_empinfo " 
     Dim cmd1 As New OleDbCommand 
     Dim da As New OleDbDataAdapter 


     With cmd1 
      .CommandText = sqlQuery 
      .Connection = con 
      With SqlAdapter 
       .SelectCommand = cmd1 
       .Fill(Table) 
      End With 
      With DataGridView1 
       .DataSource = Table 
      End With 
     End With 

     con.Close() 
    End Sub 

Answer 1

您的查询语法错误。由于您使用的参数，可以使用占位符在SQL：（问号是不是有些“等”类型的东西，你用?标记参数！）：

Dim sqlQuery As String = "UPDATE tbl_empinfo SET FirstName = ?, 
      LastName=?, Department=?, 
      Status=?, Years=? WHERE empID = ?" 

注：六个参数

' USING will dispose of the cmd when it is done with it 
' ...can also set the SQL and connection props in the constructor: 
Using cmd As New OleDbCommand(sqlQuery, con) 
    With cmd 
     ' no reason to move Textboxes to a variable either: 
     .Parameters.AddWithValue("@p1", empFnameText.Text) 
     .Parameters.AddWithValue("@p2", empLnameText.Text) 
     .Parameters.AddWithValue("@p3", DeptText.Text) 
     .Parameters.AddWithValue("@p4", StatText.Text) 
     .Parameters.AddWithValue("@p5", yearstext.Text) 

丢失的6个参数：

 .Parameters.AddWithValue("@p6", eNumText.Text)   
     .ExecuteNonQuery() 
    End With 
End Using 

我不认为访问支持命名参数，可以让你在指定的顺序使用哑的人，但一定要AddWithValue SQL字符串。

编辑

您只需创建嵌入，而不是使用PARAMS是你的SQL字符串做什么样值的SQL字符串。 Params更好（研究SQL注入攻击），但是你的字符串方法是错误的（你不能混合方法）。它应该是：

Dim sqlQuery As String = "UPDATE tbl_empinfo " & 
     "SET FirstName = " & empFname & ", LastName=" & empLname 

的变量必须在引号外面，否则你会被设置FirstName字面“empFname”