c# - ORA-01756 :quoted string not properly terminated Exception

Question

我正在使用以下查询执行插入语句，但在标题上抛出了异常。我试图调试查询但无法弄清楚哪里出错了。我不想使用参数化查询。

OracleCommand cmd = new OracleCommand("INSERT INTO AML_PERCENTAGE_COMPARATOR ( FIRSTNAME, MIDDLENAME, LASTNAME, WHOLENAME, PERCENTAGE ) VALUES ('" + ListOfAML[i].firstName + "','" + ListOfAML[i].middleName + "','" + ListOfAML[i].lastName + "','" + ListOfAML[i].wholeName + "','" + compare + "')");

Answer 1

nvoigt already explained你的问题。我尝试将其作为示例展示；

正如我所说，单引号在 SQL DBMS 中具有特殊含义。如果您想在命令中将它们用作 string literal , you need to double them .

使用 parameterized queries 处理它们的最佳方法.这种字符串连接也对 SQL Injection 开放。攻击。

using(var con = OracleConnection(conString))
using(var cmd = con.CreateCommand())
{
   cmd.CommandText = "INSERT INTO AML_PERCENTAGE_COMPARATOR(FIRSTNAME, MIDDLENAME, LASTNAME, WHOLENAME, PERCENTAGE )
                      VALUES(:firstname, :middlename, :lastname, :wholeName, :compare)";
   cmd.Parameters.AddWithValue("firstname", ListOfAML[i].firstName);
   cmd.Parameters.AddWithValue("middlename", ListOfAML[i].middleName);
   cmd.Parameters.AddWithValue("lastname", ListOfAML[i].lastName);
   cmd.Parameters.AddWithValue("wholeName", ListOfAML[i].wholeName);
   cmd.Parameters.AddWithValue("compare", compare);

   con.Open();
   cmd.ExecuteNonQuery();
}