c# - 我正在尝试插入到 sql server 中的表中，但它给出了一个错误，即关键字 'of' 附近的语法不正确

Question

                DBConnection objconn = new DBConnection();
              objconn.connection(); //calling connection   

              System.Data.SqlClient.SqlCommand com = new System.Data.SqlClient.SqlCommand("tbl_srsdata", objconn.con);
              com.CommandType = System.Data.CommandType.Text;
              var rows = Table1.Items;
     TextBlock field;
              TextBlock type;
              TextBlock datatype;
              TextBlock len;
              TextBlock buis;
              int id;
     id = Redirect.identity;
              MessageBox.Show(id.ToString());
              for (int i = 0; i < rows.Count; i++)
              {
     DataGridRow row = (DataGridRow)Table1.ItemContainerGenerator.ContainerFromIndex(i);
                  for (int j = 0; j < Table1.Columns.Count; j++)
                  {
                      field = Table1.Columns[j].GetCellContent(row) as TextBlock;
                      j++;
                      type = Table1.Columns[j].GetCellContent(row) as TextBlock;
                      j++;
                      datatype = Table1.Columns[j].GetCellContent(row) as TextBlock;
                      j++;
                      len = Table1.Columns[j].GetCellContent(row) as TextBlock;
                      j++;
                      buis = Table1.Columns[j].GetCellContent(row) as TextBlock;
                      j++;
    com.CommandText = "insert into tbl_srsdata(id,field,[type_of_control],datatype,length,other_buisness_rules) values( " + id + ", " + field.Text + "," + type.Text + "," + datatype.Text + "," + len.Text + "," + buis.Text + ");"; 
                      com.ExecuteNonQuery();
                  }
    }

我在最后一行收到一个错误。错误是: System.Data.dll 中出现“System.Data.SqlClient.SqlException”类型的异常，但未在用户代码中处理。 附加信息:关键字“of”附近的语法不正确。 谁能帮我解决这个问题。

Answer 1

将 TextBox 中的文本集成到查询中是个坏主意。

您必须添加文本作为参数:

com.CommandText = "insert into tbl_srsdata(id,field,[type_of_control],datatype,length,other_buisness_rules) values(@id,@field,@type,@datatype,@len,@buis)";
com.Parameters.AddWithValue("@id", id);
com.Parameters.AddWithValue("@field", field.Text);
com.Parameters.AddWithValue("@type", type.Text);
com.Parameters.AddWithValue("@datatype", datatype.Text);
com.Parameters.AddWithValue("@len", len.Text);
com.Parameters.AddWithValue("@buis", buis.Text);
com.ExecuteNonQuery();

将文本直接集成到查询中可能会导致错误和安全问题。

我不知道你的程序是什么逻辑。但我建议(这可能是错误的)这样写:

if (!Table1.Items.Any())
    return;

string strInsertCmd = 
    "insert into tbl_srsdata(id,field,[type_of_control],datatype,length,other_buisness_rules)"+
    "values(@id,@field,@type,@datatype,@len,@buis)";

using (var com = new System.Data.SqlClient.SqlCommand(strInsertCmd, objconn.con))
{
    var rows = Table1.Items;
    int id;
    id = Redirect.identity;
    MessageBox.Show(id.ToString());
    for (int i = 0; i < rows.Count; i++)
    {
        DataGridRow row = (DataGridRow)Table1.ItemContainerGenerator.ContainerFromIndex(i);
        var field = Table1.Columns[0].GetCellContent(row) as TextBlock;
        var type = Table1.Columns[1].GetCellContent(row) as TextBlock;
        var datatype = Table1.Columns[2].GetCellContent(row) as TextBlock;
        var len = Table1.Columns[3].GetCellContent(row) as TextBlock;
        var buis = Table1.Columns[4].GetCellContent(row) as TextBlock;

        com.Parameters.Clear();
        com.Parameters.AddWithValue("@id", id);
        com.Parameters.AddWithValue("@field", field.Text);
        com.Parameters.AddWithValue("@type", type.Text);
        com.Parameters.AddWithValue("@datatype", datatype.Text);
        com.Parameters.AddWithValue("@len", len.Text);
        com.Parameters.AddWithValue("@buis", buis.Text);
        com.ExecuteNonQuery();
    }
}