mysql - 在vb net中插入新行

Question

这就是我在 vb.net 的 MYSQL 上插入新人的方式

Dim cmd2 As New MySqlCommand("INSERT INTO login (username, password) VALUES (username ,
 password)", db_con)

或者有更好的方法来做到这一点。

Answer 1

为了防止 SQL 注入(inject)，你必须使用参数化查询。我给你一个函数的引用，你必须让你的函数类似于这样

插入函数

Public Shared Function InsertFile(ByVal name As String, ByVal pwd As String) As Integer
Dim sql As String
sql = "insert into login (username,password) values (?uname, ?upass);"
Dim params1(2) As MySqlParameter
params1(1) = New MySqlParameter("?uname", name )
params1(2) = New MySqlParameter("?upass", pwd )
Return MySqlHelper.ExecuteNonQuery(sql, params1)
End Function

现在创建一个新的ExecuteNonQuery函数来执行查询

执行非查询函数

Public Shared Function ExecuteNonQuery(ByVal sql As String, ByVal params() As MySqlParameter) As Integer
Dim cnn As New MySqlConnection(connectionstring)
Dim cmd As New MySqlCommand(sql, cnn)
For i As Integer = 0 To params.Length - 1
cmd.Parameters.Add(params(i))
Next
cnn.Open()
Dim retval As Integer = cmd.ExecuteNonQuery()
cnn.Close()
Return retval
End Function

就是这样，希望你能理解。