asp.net - 图片上传时 MySQL 语法错误

Question

我在网站上上传了一个小文件，该文件应该上传选定的图像并将其放入 mysql 数据库中。图像存储为 varbinary 类型(8000 长度)。我的代码是:

 Public Sub btnSave_Click(ByVal sender As Object, ByVal e As System.EventArgs)
    If fileupload1.HasFile Then

        Dim pimage As Byte() = fileupload1.FileBytes
        Dim pid As String = partnum.Text.ToString
        Dim sConnection As String = "DRIVER={MySQL ODBC 3.51 Driver}; SERVER=localhost; DATABASE=inteva; UID=root; PASSWORD=root; OPTION=3"
        Dim connectme As New OdbcConnection(sConnection)
        Dim sInsertInto As String = "INSERT INTO images(serial, image1) VALUES(?pserial, ?ppimage)"
        Dim com As New OdbcCommand(sInsertInto, connectme)

        com.Parameters.Add("pserial", OdbcType.VarChar).Value = pid
        com.Parameters.Add("?ppimage", OdbcType.VarBinary).Value = pimage

        connectme.Open()
        Dim result As Integer = com.ExecuteNonQuery()
        connectme.Close()

        If result > 0 Then
            lblimageup.Text = "Image saved."
        End If

    Else
        lblimageup.Text = "Please select an image file"

    End If
End Sub

当我执行此命令时，我收到如下语法错误:

ERROR [42000] [MySQL][ODBC 3.51 Driver][mysqld-5.6.11]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'pserial, 'ÿØÿá/þExif\0\0MM\0*\0\0\0\0\0\0\0\0\0\0\0’\0\0\0\0   \0\' at line 1

我似乎找不到任何语法错误。有任何想法吗？难道是图像文件中的某些内容破坏了语法？

Answer 1

尝试使用下面的代码，在SQL和Patameters.Add中使用@paramName

Dim sInsertInto As String = "INSERT INTO images(serial, image1) VALUES (@pserial, @ppimage)"
Dim com As New OdbcCommand(sInsertInto, connectme)

com.Parameters.Add("@pserial", OdbcType.VarChar).Value = pid
com.Parameters.Add("@ppimage", OdbcType.VarBinary).Value = pimage