sql-server - 我收到错误 “Incorrect syntax near the keyword '，其中“”

Question

我正在尝试更新SQL Server表(连接到WPF项目)，并且收到消息

Incorrect syntax near the keyword WHERE

我的代码有什么问题？

private void Save_button_Click(object sender, RoutedEventArgs e)
{
    try
    {
        Select("INSERT INTO [dbo].[Users](sumScore, doneLevels) VALUES ('" + ClsGlobal.sumScore + "','" + ClsGlobal.DoneLevels + "') WHERE [userName]= '" + ClsGlobal.userName + "'");
    }
    catch (Exception ex)
    { 
        MessageBox.Show(ex.Message); 
    }
}

public DataTable Select(string selectSQL) 
{
    DataTable dataTable = new DataTable("dataBase");                                                                                         

    SqlConnection sqlConnection = new SqlConnection(@"Data Source =(LocalDB)\MSSQLLocalDB; AttachDbFilename = C:\Users\Avraham\AppData\Local\Microsoft\Microsoft SQL Server Local DB\Instances\MSSQLLocalDB\New Database.mdf ");

    sqlConnection.Open();                                           

    SqlCommand sqlCommand = sqlConnection.CreateCommand();          
    sqlCommand.CommandText = selectSQL;                            

    SqlDataAdapter sqlDataAdapter = new SqlDataAdapter(sqlCommand); 
    sqlDataAdapter.Fill(dataTable);                                 

    return dataTable;
}

我会尝试使[和]或(和)靠近用户名一词，但这仍然行不通。

Answer 1

该查询:

INSERT INTO [dbo].Users
    VALUES ('" + ClsGlobal.sumScore + "','" + ClsGlobal.DoneLevels + "')
   WHERE [userName]= '" + ClsGlobal.userName;

没有道理。 INSERT插入新行，因此 WHERE不适合。

也许您想要一个 UPDATE:

UPDATE dbo.Users
    SET sumScore = ?,
        DoneLevels = ?
    WHERE userName = ?;

您应该将 ClsGlobal.sumScore， ClsGlobal.DoneLevels和 ClsGlobal.userName作为参数传递，而不是浪费查询字符串。