c# asp.net - 将数据插入数据库(不知道我哪里出错了)

Question

c# asp.net - 将数据插入数据库(不知道我在哪里出错) - 此代码正在执行但根本不起作用!我试图通过我创建的网站提供数据，但它不会在我的数据库中反射(reflect)出来，请帮助!!!!

using System;
using System.Configuration;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;
using System.Data.SqlClient;
public partial class _Default : System.Web.UI.Page

{
    SqlConnection con = new SqlConnection("Data Source=GARGI-PC\\ROOT;Initial Catalog=master;Integrated Security=True");
    protected void page_load(object sender, EventArgs e)
    {}

    public void refress()
    {

        comment1.Text = "";

        software1.Checked = true;

        hardware1.Checked = false;

        both1.Checked = false;

        others.Checked = false;
    }
    protected void btn(object sender, EventArgs e)
    {
        string type = string.Empty ;

        if (hardware1.Checked == true)
        {
            type =  "hardware";
        }
         if (software1.Checked == true)
        {
            type = "software";
        }
         if (both1.Checked == true)
        {
            type = "both";
        }
         if (others.Checked == true)
        {
            type = "others";
        }



        SqlCommand cmd = new SqlCommand("insert into main_page (type, discription,time) values('" + type + "','" + comment1.Text + "','" + "','"+"now()')", con);

        cmd.CommandType = CommandType.Text;

        try

        {

            con.Open();

            cmd.ExecuteNonQuery();

            con.Close();

            refress();

        }

        catch (Exception ex)

        { 

        }

    }

   public void btn_clear(object sender, EventArgs e)

    {
        refress();

    }

}

Answer 1

看起来您的 INSERT 语句中有一个双逗号。

+ "','" + "','"

INSERT 语句应该如下所示:

INSERT INTO main_page (type, description, time) VALUES ('Type', 'Description', NOW())

你也容易受到 SQL 注入(inject)攻击，你应该 paramerterize your queries对于您的所有输入，而不是相信来自用户的数据。作为一个基本示例:

MySqlCommand command = new MySqlCommand("INSERT INTO main_page (Description) VALUES @Description");
command.Parameters.AddWithValue("@Description", comment1.Text);

如果用户在 Comment1 文本框中输入 SQL 语句，这将保护您。

ArbitaryData; DROP TABLE main_page;