Question

private void ButtonOk_Click(object sender, EventArgs e)
    {
        if (txtWedstrijdSchemaID.Text == "")
        {
            //Insert
            string SQL;
            SQL = "Insert into Wedstrijdschema (Team1, Team2, Datum)";
            SQL += " values (";
            SQL += "" + txtTeam1.Text + ",";
            SQL += "" + txtTeam2.Text + ",";
            SQL += "" + Convert.ToDateTime(txtDatum.Text) + "";
            SQL += ")";

            clDatabase.ExecuteCommand(SQL);
            vulLv();
        }
        else
        {
            //Update
            string SQL;
            SQL = "Update Wedstrijdschema SET ";
            SQL += "Team1 = " + txtTeam1.Text + ",";
            SQL += "Team2 = " + txtTeam2.Text + ",";
            SQL += "Datum = " + Convert.ToDateTime(txtDatum.Text) + "";
            SQL += " where SchemaId = " + zoek;

            clDatabase.ExecuteCommand(SQL);
            vulLv();
        }
        txtDatum.Enabled = txtTeam2.Enabled = txtTeam1.Enabled = false;
    }

这就是我目前所拥有的，因为我尝试时它不会崩溃，如果我在//插入上注释txtDatum.Text并且//上传它可以正常工作（但显然为Datum输入NULL）数据库）有没有人可能会看到我哪里出错了？

编辑：关于参数的使用，我们需要使用一个threetier系统，其中所有SQL都通过一个类，这是唯一允许对数据库执行任何操作的类，这就是命令的执行方式：

public static bool ExecuteCommand(string SQLInstructie)
        {
            bool retour = true;
            SqlConnection Conn = new SqlConnection(clStam.Connstr);
            SqlCommand Cmd = new SqlCommand(SQLInstructie, Conn);

            try
            {
                Cmd.Connection.Open();
                Cmd.ExecuteNonQuery();
            }
            catch
            {
                retour = false;
            }
            finally
            {
                Conn.Close();
            }
            return retour;
        }

这个有效!!非常感谢您的帮助：

private void ButtonOk_Click(object sender, EventArgs e)
        {
            if (txtWedstrijdSchemaID.Text == "")
            {
                //Insert

                string SQL;
                SQL = "Insert into Wedstrijdschema (Team1, Team2, Datum)";
                SQL += " values (";
                SQL += "" + txtTeam1.Text + ",";
                SQL += "" + txtTeam2.Text + ",";
                SQL += "'" + Convert.ToDateTime(txtDatum.Text) + "'";
                SQL += ")";
                Debug.WriteLine(SQL);
                clDatabase.ExecuteCommand(SQL);
                vulLv();
            }
            else
            {
                //Update
                string SQL;
                SQL = "Update Wedstrijdschema SET ";
                SQL += "Team1 = " + txtTeam1.Text + ",";
                SQL += "Team2 = " + txtTeam2.Text + ",";
                SQL += "Datum = '" + Convert.ToDateTime(txtDatum.Text) + "'";
                SQL += " where SchemaId = " + zoek;

                clDatabase.ExecuteCommand(SQL);
                vulLv();
            }
            txtDatum.Enabled = txtTeam2.Enabled = txtTeam1.Enabled = false;
        }

编辑：我承诺从现在开始使用参数化SQL！

Answer 1

您错过了,和INSERT声明中的UPDATE命令。

将数据插入数据库的语法是：

 INSERT INTO Table 
        (Column1, Column2, Column3) 
 VALUES
        ('Value 1', 'Value 2', 'Value3')

除此之外，您很容易受到SQL injection的攻击，使用SQL参数化查询来阻止这种情况。

我首先要使用SqlCommand对象开始。

SqlCommand cmd = new SqlCommand("INSERT INTO Wedstrijdschema (Team1, Team2, Datum) VALUES (@V1, @V2, @V3");

cmd.Parameters.AddWithValue("@V1", txtTeam1.Text);
cmd.Parameters.AddWithValue("@V2", txtTeam2.Text);
cmd.Parameters.AddWithValue("@V3", Convert.ToDateTime(txtDatum.Text));

然后使用cmd.ExecuteNonQuery();

执行它

作为补充说明，我还要确保将txtDatum中的值正确转换为所需的日期格式。

Answer 2

从datetime列中删除单引号。你也错过了要在插入语句中添加的列

private void ButtonOk_Click(object sender, EventArgs e)
        {
            if (txtWedstrijdSchemaID.Text == "")
            {
                //Insert
                string SQL;
                SQL = "Insert into Wedstrijdschema (Team1, Team2,**Datum**)";
                SQL += " values (";
                SQL += "" + txtTeam1.Text + ",";
                SQL += "" + txtTeam2.Text + "";
                SQL += "" + Convert.ToDateTime(txtDatum.Text) + "";
                SQL += ")";

                clDatabase.ExecuteCommand(SQL);
                vulLv();
            }
            else
            {
                //Update
                string SQL;
                SQL = "Update Wedstrijdschema SET ";
                SQL += "Team1 = " + txtTeam1.Text + ",";
                SQL += "Team2 = " + txtTeam2.Text + "";
                SQL += "Datum = " + Convert.ToDateTime(txtDatum.Text) + "";
                SQL += " where SchemaId = " + zoek;

                clDatabase.ExecuteCommand(SQL);
                vulLv();
            }
            txtDatum.Enabled = txtTeam2.Enabled = txtTeam1.Enabled = false;
        }

Answer 3

始终使用parameterized queries.string连接构成sql注入的方法

private void ButtonOk_Click(object sender, EventArgs e)
{
    if (txtWedstrijdSchemaID.Text == "")
    {
    SqlCommand cmd = new SqlCommand("Insert into Wedstrijdschema (Team1, Team2, Datum)  values (@Team1,@Team2,@datetime)"); 
     cmd.Parameters.AddWithValue("@Team1",txtTeam1.Text 
     cmd.Parameters.AddWithValue("@Team2",txtTeam2.Text              
     cmd.Parameters.AddWithValue("@datetime",Convert.ToDateTime(txtDatum.Text)     
     clDatabase.ExecuteCommand(SQL);
     vulLv();
    }
    else
    {
    SqlCommand cmd = new SqlCommand("Update Wedstrijdschema SET Team1=@team1,Team2=@team2,Datum =@Datum where SchemaId=@SchemaId");
     cmd.Parameters.AddWithValue("@team1",txtTeam1.Text );
     cmd.Parameters.AddWithValue("@team2",txtTeam2.Text);              
     cmd.Parameters.AddWithValue("@Datum ",Convert.ToDateTime(txtDatum.Text);
     cmd.Parameters.AddWithValue("@SchemaId",zoek);
     clDatabase.ExecuteCommand(SQL);
     vulLv();
    }
    txtDatum.Enabled = txtTeam2.Enabled = txtTeam1.Enabled = false;
}

Answer 4

使用ToString以可接受的格式设置日期格式（并在将其作为字符串传递时用引号括起来）：

string SQL;
    SQL = "Insert into Wedstrijdschema (Team1, Team2, Datum)";
    SQL += " values (";
    SQL += "" + txtTeam1.Text + ",";
    SQL += "" + txtTeam2.Text + ",";
    SQL += "'" + Convert.ToDateTime(txtDatum.Text).ToString("yyyy-MM-dd HH:mm:ss") + "'";
    SQL += ")";

将日期时间插入并更新到SQL数据库中

4 个答案: