我使用以下代码更新我的某个Windows窗体上的“商家”信息。当用户将商家名称放在txtBusName中,如“桑迪的地方”时,我会收到Incorrect Syntax near ';'. Unclosed quotation mark after the character string ';'.
处理此问题的最佳方法是什么?
conn = new SqlConnection(connString);
conn.Open();
SqlCommand cmd = conn.CreateCommand();
mskZip.TextMaskFormat = MaskFormat.ExcludePromptAndLiterals;
string zip = mskZip.Text;
mskZip.TextMaskFormat = MaskFormat.IncludeLiterals;
mskMailZip.TextMaskFormat = MaskFormat.ExcludePromptAndLiterals;
string mailzip = mskMailZip.Text;
mskMailZip.TextMaskFormat = MaskFormat.IncludeLiterals;
mskPhone.TextMaskFormat = MaskFormat.ExcludePromptAndLiterals;
string phone = mskPhone.Text;
mskPhone.TextMaskFormat = MaskFormat.IncludeLiterals;
mskFax.TextMaskFormat = MaskFormat.ExcludePromptAndLiterals;
string fax = mskFax.Text;
mskFax.TextMaskFormat = MaskFormat.IncludeLiterals;
cmd.CommandText = "Update Business SET Name='" + txtBusName.Text + "', ContactName='" + txtContName.Text +
"', Address='" + txtAddr1.Text + "', City='" + txtCity.Text + "', State='" + cmbState.Text + "', Zip=" + ((zip=="")?"NULL":zip) + ", " +
"MailAddress='" + txtMailAddr1.Text + "', MailCity='" + txtMailCity.Text + "', MailState='" + cmbMailState.Text +
"', MailZipcode=" + ((mailzip == "") ? "NULL" : mailzip) + ", Latitude=" + ((txtLat.Text == "") ? "NULL" : txtLat.Text) + ", Longitude=" + ((txtLong.Text == "") ? "NULL" : txtLong.Text) + ", Phone=" +
((phone == "") ? "NULL" : phone) + ", Fax=" + ((fax == "") ? "NULL" : fax) + ", Email='" + txtEmail.Text + "' " +
"WHERE BusinessID=" + busID + " AND Status='A';";
cmd.ExecuteNonQuery();
MessageBox.Show("Database updated successfully.");
this.Close();
答案 0 :(得分:2)
使用双引号在SQL中转义单引号,因此Sandy''s place
应该有效。
我强烈建议使用查询参数而不是将您自己的查询串在一起,这样可以解决潜在的安全风险(SQL注入)以及最常见的问题,例如引号。
答案 1 :(得分:1)
请使用SqlParameter对象,而不是像这样的字符串连接。类似的东西:
string sql = "Update Business SET Name=@Name, ContactName=@ContactName, Address=@Address WHERE BusinessID=@BusinessID AND Status='A';";
System.Data.SqlClient.SqlParameter[] par = new System.Data.SqlClient.SqlParameter[4];
par[0] = new System.Data.SqlClient.SqlParameter("@Name", txtBusName.Text);
par[1] = new System.Data.SqlClient.SqlParameter("@ContactName", txtContName.Text);
par[2] = new System.Data.SqlClient.SqlParameter("@Address", txtAddr1.Text);
par[3] = new System.Data.SqlClient.SqlParameter("@BusinessID", busID);
System.Data.SqlClient.SqlCommand com = new System.Data.SqlClient.SqlCommand(sql, SQL_CONNECTION);
com.Parameters.AddRange(par);
com.ExecuteNonQuery();
你有太多参数,所以没有全部写出来:)
使用这种方法将为您提供像撇号这样的特殊字符,并使代码看起来更干净,更易读,更安全。
答案 2 :(得分:1)
最好的方法是使用参数化查询。
答案 3 :(得分:1)
您需要使用parameterized query这样的
cmd.CommandText =
"Update Business SET Name=@name, ContactName=@contact, Address=@address, " +
"City=@city, State=@state, Zip=@zip, " +
"MailAddress=@mail, MailCity=@ecity, MailState=@estate, " +
"MailZipcode=@ezip, Latitude=@lat, Longitude=@lng, Phone=@phone, " +
"Fax=@fax, Email=@email " +
"WHERE BusinessID=@busID AND Status='A'";
cmd.Parameters.AddWithValue("@name", txtBusName.Text);
cmd.Parameters.AddWithValue("@contact", txtContName.Text);
cmd.Parameters.AddWithValue("@address", txtAddr1.Text);
cmd.Parameters.AddWithValue("@city", txtCity.Text);
cmd.Parameters.AddWithValue("@state", cmbState.Text);
SqlParameter p1 = cmd.Parameters.Add("@zip", SqlDbType.NVarChar);
if(zip == "") p1.Value = DBNull.Value; else p1.Value = zip;
cmd.Parameters.AddWithValue("@mail", txtMailAddr1.Text);
cmd.Parameters.AddWithValue("@ecity", txtMailCity.Text);
cmd.Parameters.AddWithValue("@estate", cmbMailState.Text);
p1 = cmd.Parameters.Add("@ezip", SqlDbType.NVarChar);
if (mailzip == "") p1.Value = DBNull.Value; else p1.Value = mailzip;
p1 = cmd.Parameters.Add("@lat", SqlDbType.NVarChar);
if (txtLat.Text == "") p1.Value = DBNull.Value; else p1.Value = txtLat.Text;
p1 = cmd.Parameters.Add("@lng", SqlDbType.NVarChar);
if (txtLong.Text == "") p1.Value = DBNull.Value; else p1.Value = txtLong.Text;
p1 = cmd.Parameters.Add("@phone", SqlDbType.NVarChar);
if (phone == "") p1.Value = DBNull.Value; else p1.Value = phone;
p1 = cmd.Parameters.Add("@fax", SqlDbType.NVarChar);
if (fax == "") p1.Value = DBNull.Value; else p1.Value = fax;
cmd.Parameters.AddWithValue("@email", txtEmail.Text );
cmd.Parameters.AddWithValue("@busID", busID);
上面链接的文章值得从头到尾阅读,但总而言之,使用参数化查询,您可以将单引号(以及数字小数和日期文字)格式化为更好地了解的框架代码比我和你如何处理这些字符串,并以这种方式避免可能使您的数据库暴露黑客的可怕Sql Injection问题
注意:我不知道应该设置为null的列的实际数据类型,所以我假设它们都是NVARCHAR。如果不是这种情况,那么您应该用适当的值替换SqlDbType。