c# - 通过C#在sql中插入数据

Question

我已成功创建数据库连接，但现在插入数据时遇到问题。这是我的代码:

String Connection = null;
SqlConnection con;
SqlCommand cmd;
String sql = null;
Connection="Data Source=DELL\\SQLEXPRESS; initial Catalog= BSSE;Integrated Security=True";
con = new SqlConnection(Connection);
sql = "INSERT INTO Records (Roll_No,Name,Marks) VALUES (" + textBox1.Text + "," + textBox2.Text + "," + textBox3.Text + ");";
try
{
    con.Open();
    cmd = new SqlCommand(sql, con);
    cmd.ExecuteNonQuery();
    MessageBox.Show ("Success of data insertion ");
    cmd.Dispose();
    con.Close();
}
catch (Exception ex)
{
    MessageBox.Show("Can not open connection ! ");
}

Answer 1

首先，你的SQL语句不正确。您在值字段之间缺少单引号。稍后，您使用字符串连接构建 SQL 语句，这很危险，因为可能会暴露给 SQL Injection 。使用Parameterized Query相反。

try
{
    con.Open();
    cmd = new SqlCommand("INSERT INTO Records (Roll_No,Name,Marks) VALUES (@rollNo, @Name, @Marks)", con);
    cmd.Parameters.AddWithValue("@rollNo", textBox1.Text);
    cmd.Parameters.AddWithValue("@Name", textBox2.Text);
    cmd.Parameters.AddWithValue("@Marks", textBox3.Text);
    cmd.ExecuteNonQuery();

    MessageBox.Show ("Success of data insertion ");
    cmd.Dispose();
    con.Close();
}
catch (Exception ex)
{
    MessageBox.Show("Can not open connection ! ");
}