c# - 格式化换行符或将换行符插入查询

Question

我正在从数据库调用数据。所有数据都从一张表中调用，并显示为:例如:马克是一个男孩，詹姆斯是一个男孩，特林是一个女孩，特米是一个女孩，......

我想实现:

马克是个男孩

詹姆斯是个男孩

Trin是个女孩

特米是个女孩

我将如何格式化此代码来实现这一目标？

string query= "INSERT INTO education (institutionname,programme,graduationdate,certawarded) 
               VALUES ('" + txtboxinstname.Text + "', '" + txtboxprogramme.Text + "', '" + txtboxgraddate.Text + "', '" + txtboxcertawarded.Text + "')";

command = new MySqlCommand(dy_query, con);
command.ExecuteNonQuery();

Answer 1

嗯，你可以使用verbatim string .

To indicate that a string literal is to be interpreted verbatim. The @ character in this instance defines a verbatim string literal. Simple escape sequences (such as "\" for a backslash), hexadecimal escape sequences (such as "\x0041" for an uppercase A), and Unicode escape sequences (such as "\u0041" for an uppercase A) are interpreted literally. Only a quote escape sequence ("") is not interpreted literally; it produces a single quotation mark. Additionally, in case of a verbatim interpolated string brace escape sequences ({{ and }}) are not interpreted literally; they produce single brace characters. The following example defines two identical file paths, one by using a regular string literal and the other by using a verbatim string literal. This is one of the more common uses of verbatim string literals.

您也不应该使用字符串连接来构建 SQL 查询。特别是当您直接从用户那里获取输入时。这将为您打开SQL injection attack 。相反，您应该使用参数。

string query = @"INSERT INTO education
(institutionname,programme,graduationdate,certawarded)
VALUES
(@institutionname,@programme,@graduationdate,@certawarded)";

command = new MySqlCommand(query, con);

// I'm not familiar with MySqlCommand. I'm assuming it is similar to SqlCommand, but the
// Parameters property and the AddWithValue method my be named something else. You'll
// have to check for yourself.
command.Parameters.AddWithValue("institutionname", txtboxinstname.Text);
command.Parameters.AddWithValue("programme", txtboxprogramme.Text);
command.Parameters.AddWithValue("graduationdate", txtboxgraddate.Text);
command.Parameters.AddWithValue("certawarded", txtboxcertawarded.Text);
command.ExecuteNonQuery();