c# - 循环插入问题，重新加载页面加载？

Question

我试图在页面加载中使用我的函数实现插入语句并返回。不确定如何在插入的同时将插入到 mysql 中的内容一次全部拉回来？

代码:

public partial class UserProfileWall : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        string theUserId = Session["UserID"].ToString();
        using (OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=user_name; Password=password_here;"))
        {
            cn.Open();
            using (OdbcCommand cmd = new OdbcCommand("SELECT Wallpostings FROM WallPosting WHERE UserID=" + theUserId + " ORDER BY idWallPosting DESC", cn))

            using (OdbcDataReader reader = cmd.ExecuteReader())
            {
                var divHtml = new System.Text.StringBuilder();
                while (reader.Read())
                {
                    divHtml.Append("<div id=test>");
                    divHtml.Append(String.Format("{0}", reader.GetString(0)));
                    divHtml.Append("</div>");
                }
                test1.InnerHtml = divHtml.ToString();
            }
        }
    }

    protected void Button1_Click(object sender, EventArgs e)
    {
        string theUserId = Session["UserID"].ToString();
        OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=user_name; Password=password_here;");
        cn.Open();

        OdbcCommand cmd = new OdbcCommand("INSERT INTO WallPosting (UserID, Wallpostings) VALUES (" + theUserId + ", '" + TextBox1.Text + "')", cn);
        cmd.ExecuteNonQuery();
    //    {
    //        using (OdbcCommand md = new OdbcCommand("SELECT Wallpostings FROM WallPosting WHERE UserID=" + theUserId + "", cn))

    //        using (OdbcDataReader reader = cmd.ExecuteReader())
    //        {
    //            var divHtml = new System.Text.StringBuilder();
    //            while (reader.Read())
    //            {
    //                divHtml.Append("<div id=test>");
    //                divHtml.Append(String.Format("{0}", reader.GetString(0)));
    //                divHtml.Append("</div>");
    //            }
    //            test1.InnerHtml = divHtml.ToString();
    //        }
    //    }
    //}
}

我确实尝试了注释掉的那一行，但是我得到了多个插入，并且页面上没有重新加载任何内容。插入后有没有简单的方法获取页面加载功能？

Answer 1

首先，将用墙贴填充元素的代码移到单独的函数中:

private void PopulateWallPosts(string userId)
{
    using (OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=user_name; Password=password_here;"))
        {
        cn.Open();
        using (OdbcCommand cmd = new OdbcCommand("SELECT Wallpostings FROM WallPosting WHERE UserID=" + userId) + " ORDER BY idWallPosting DESC", cn))
        {
            using (OdbcDataReader reader = cmd.ExecuteReader())
            {
                var divHtml = new System.Text.StringBuilder();
                while (reader.Read())
                {
                    divHtml.Append("<div id=test>");
                    divHtml.Append(String.Format("{0}", reader.GetString(0)));
                    divHtml.Append("</div>");
                }
                test1.InnerHtml = divHtml.ToString();
            }
        }
    }
}

现在在 Page_Load 中调用它:

protected void Page_Load(object sender, EventArgs e)
{
    string theUserId = Session["UserID"].ToString();
    PopulateWallPosts(theUserId);
}

最后在插入新值后调用它:

protected void Button1_Click(object sender, EventArgs e)
{
    string theUserId = Session["UserID"].ToString();
    using (OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=user_name; Password=password_here;"))
    {
        cn.Open();
        using (OdbcCommand cmd = new OdbcCommand("INSERT INTO WallPosting (UserID, Wallpostings) VALUES (" + theUserId + ", '" + TextBox1.Text + "')", cn))
        {
            cmd.ExecuteNonQuery();
        }
    }
    PopulateWallPosts(theUserId);
}

您的注释代码不起作用，因为您再次执行了 INSERT INTO 命令而不是 SELECT 命令。

无论如何，您最好了解 SQL 注入(inject)并更改您的代码以使用参数而不是直接将用户 ID 添加到 SQL 字符串。