c# - 从文本框值运行 SQL 命令

Question

我创建了一个小项目，从 sqlserver 读取数据然后插入 mysql 表。我希望用户将 SQL 和 mysql 命令写入文本框。

这是我的问题，当我运行项目时，插入 mysql 表的字段是: myReader["STableName"].ToString()

喜欢这张图片:

连接正常，这是我的代码:

            string address;
            string username;
            string password;
            string database;
            address = textBox1.Text;
            username = textBox2.Text;
            password = textBox3.Text;
            database = textBox4.Text;


            //MySql
            string mysqladdress;
            string mysqlusername;
            string mysqlpassword;
            string mysqldatabase;
            mysqladdress = textBox7.Text;
            mysqlusername = textBox8.Text;
            mysqlpassword = textBox9.Text;
            mysqldatabase = textBox10.Text;

            //SQLCode 
            string sqlcmnd1;
            string sqlcmnd2;
            sqlcmnd1 = textBox5.Text;
            sqlcmnd2 = textBox6.Text;


            SqlConnection conn = new SqlConnection();
            conn.ConnectionString =
            "Data Source=" + address + ";" +
            "Initial Catalog=" + database + ";" +
            "User id=" + username + ";" +
            "Password=" + password + ";";
            try
            {
                conn.Open();       
                SqlDataReader myReader = null;
                SqlCommand myCommand = new SqlCommand(sqlcmnd1, conn);
                myReader = myCommand.ExecuteReader();    
                while (myReader.Read())
                {
                    string connectionString = @"server=" + mysqladdress + ";" + "username=" + mysqlusername + ";" + "password=" + mysqlpassword + ";" + "database=" + mysqldatabase + "";
                    MySqlConnection connection = null;
                    MySqlDataReader reader = null;
                    try
                    {
                        connection = new MySqlConnection(connectionString);
                        connection.Open();
                        string stm = sqlcmnd2;//here is my problem
                        MySqlDataAdapter dataAdapter = new MySqlDataAdapter();
                        dataAdapter.SelectCommand = new MySqlCommand(stm, connection);
                        DataTable table = new DataTable();
                        dataAdapter.Fill(table);
                    }

sqlcmnd2:

INSERT INTO test (CusCode,STableName,Date,ModdatZaman) VALUES ('" + myReader["CusCode"].ToString() + "','" + myReader["STableName"].ToString() + "','" + myReader["Date"].ToString() + "','" + myReader["ModdatZaman"].ToString() + "')

sqlcmnd1:

SELECT * FROM __TempUserCompRep__

Answer 1

文本框中的文本被视为完整字符串，它不会替换变量的实际值。

您需要为此使用准备好的语句。

在 textbox6 中编写如下命令:

INSERT INTO test (CusCode,STableName,Date,ModdatZaman) VALUES (@CusCode,@STableName,@Date,@ModdatZaman)

之后在代码中，将参数与您实际想要获取值的变量绑定(bind)。

例如:

      MySqlConnection con = null;
        try
        {
            string myConnectionString = "server=localhost;database=test;uid=root;pwd=root;";

                con = new MySqlConnection(myConnectionString);

                string CmdString = textBox6.Text.ToString();
                MySqlCommand cmd = new MySqlCommand(CmdString, con);
                 cmd.Parameters.Add("@CusCode", MySqlDbType.VarChar, 50);
                 cmd.Parameters.Add("@STableName", MySqlDbType.VarChar, 50);
                 cmd.Parameters.Add("@Date", MySqlDbType.VarChar, 50);
                 cmd.Parameters.Add("@ModdatZaman", MySqlDbType.VarChar, 50);
                 cmd.Parameters["@CusCode"].Value = myReader["CusCode"].ToString();
                 cmd.Parameters["@STableName"].Value = myReader["STableName"].ToString();
                 cmd.Parameters["@Date"].Value = myReader["Date"].ToString();
                 cmd.Parameters["@ModdatZaman"].Value = myReader["ModdatZaman"].ToString();

                con.Open();
                int RowsAffected = cmd.ExecuteNonQuery();
                if (RowsAffected > 0)
                {
                    MessageBox.Show("Insert Query sucessfully!");
                }


        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.Message);
        }
        finally
        {
            if (con != null && con.State == ConnectionState.Open)
            {
                con.Close();
            }
        }

注意:我认为数据库中所有四列都是 varchar 类型。您可以根据您的要求进行修改