Question

我正在SQL Server Express中执行SQL语句

insert into dscl_sql_log (user_name, sql_time, sql) 
values ('ADMIN', '2/17/2014 7:05:45 PM', 'select * from cn_fieldsurvey_trn where unit_code = '03' and rownum < 10')

它会显示**incorrect syntax near '03'**

的错误消息

Answer 1

 insert into dscl_sql_log (user_name, sql_time, sql) values ('ADMIN', '2/17/2014 7:05:45 PM', 'select * from cn_fieldsurvey_trn where unit_code = ''03'' and rownum < 10')

如果从文本框中获取价值，则强烈建议使用参数化查询来防止 SQL注入攻击，并避免显式转义传递的值中的单个字符。

       string query=  @"insert into dscl_sql_log (user_name, sql_time, sql) values  " +
            " (" +
                  @"'ADMIN', '2/17/2014 7:05:45 PM',@sql "+
             ")";

        using (var cmd = new SqlCommand(query, conn))
        {
            cmd.Parameters.AddWithValue("@sql", txtbox.Text);

            cmd.ExecuteNonQuery();
        }

Answer 2

您需要用2引号替换引号，因为没有转义引号而导致错误。

insert into dscl_sql_log (user_name, sql_time, sql) values 
    ('ADMIN', '2/17/2014 7:05:45 PM',
replace('select * from cn_fieldsurvey_trn where unit_code = '03' and rownum < 10','''',''''''))

Answer 3

或者您可以这样使用：

insert into dscl_sql_log (user_name, sql_time, sql) values ('ADMIN', '2/17/2014 7:05:45 PM', 'select * from cn_fieldsurvey_trn where unit_code = ' + '03' + ' and rownum < 10')

但要小心， SQL注入问题就像他们说的那样！

Answer 4

尝试：

insert into dscl_sql_log (user_name, sql_time, sql) 
values ('ADMIN', '2/17/2014 7:05:45 PM', 'select * from cn_fieldsurvey_trn where unit_code = ''03'' and rownum < 10')

在字符串中使用2引号。

执行时语法错误

4 个答案: