c# - 从 ASP.NET 文本框向 SQL 数据库写入数据

Question

写入 SQL 数据库时，我收到“System.Web.UI.WebControls.TextBox”而不是实际数据本身。

upload.aspx.cs 文件(包含查询):

 string query = "INSERT INTO reports (birdname, location, details, image, spotteddata, uploaddata, typeofbird) VALUES ('"+birdnametext+"', 'mygarden', 'some details about how long you waited', ' " + img + "', '10th March 2014','" + dateNow + "', '2')";

upload.aspx(包含文本框):

<header> Upload </header>
<p> Please fill out the form below to put your item up for sale</p>
<p>  
<span>Name of Bird:
<asp:TextBox ID="birdnametext" runat="server"></asp:TextBox> </span>
<br/>
<asp:FileUpload ID="FileUpload1" runat="server" />
<br />
<asp:Image ID="Image1" runat="server" />
<br />

Answer 1

他们可能是你做错的事情:

1. 您正在尝试将 TextBox 本身传递给数据库，您需要改为传递它的 Text。这意味着 ...'"+ birdnametext + "' ... 应该是 ...'"+ birdnametext.Text + "' ...
2. 您正在为 injection 打开一扇宽阔的大门通过文本查询，为此使用参数化查询。

您可以像下面这样构建命令:

string query = "INSERT INTO reports(birdname, location) VALUES(@birdname, @location);
SqlCommand cmd = new SqlCommand("query,con);
cmd.Parameters.Add("@birdname", SqlDbType.VarChar).Value = birdnametext.Text;
cmd.Parameters.Add("@location", SqlDbType.VarChar).Value = "mygarden";
// similarly you can add the rest of columns and parameters 
cmd.ExecuteNonQuery();