SQL插入不起作用

时间:2013-02-26 14:24:14

标签: c# asp.net sql

当按下事件Button 没有更新SQL表并且无错误显示。

protected void SubmitBTN_Click(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(@"Data Source=(LocalDB)\v11.0;AttachDbFilename=C:\Users\Matt\Documents\coffeeShop.mdf;Integrated Security=True;Connect Timeout=30");

    String coffeeName = NameTXT.Text;
    String coffeeGrid = GrindTXT.Text;
    String coffeeOrigin = OriginTXT.Text;
    String coffeePrice = PriceTXT.Text;
    String coffeeQty = QuantityTXT.Text;
    String coffeeRRP = RRPTXT.Text;

    SqlCommand comm = new SqlCommand("INSERT INTO Table (coffeeName, coffeeGrid, coffeeOrigin, coffeePrice, coffeeQty, coffeeRRP) VALUES ('%" + coffeeName + "%','%" + coffeeGrid + "%','%" + coffeeOrigin + "%','%" + coffeePrice + "%','%" + coffeeGrid + "%','%" + coffeeQty + "%','%" + coffeeRRP + "%' ", conn);

    conn.Open();
    //SqlDataReader reader = comm.ExecuteReader();

    //lblDBData.Text += "<table border=0>";
    //while (reader.Read())
    //{
    //    lblDBData.Text += "<tr>";
    //    lblDBData.Text += "<td>" + reader["coffeeName"] + "</td>";
    //    lblDBData.Text += "</tr>";
    //}
    //lblDBData.Text += "</table>";

    //reader.Close();
    conn.Close();                     
}

非常感谢任何建议,非常感谢

5 个答案:

答案 0 :(得分:4)

添加:

comm.ExecuteNonQuery();

后:

conn.Open();

顺便说一下,您希望在查询时使用参数而不是" + parameter + "来避免sql注入。阅读本文:

http://www.csharp-station.com/Tutorial/AdoDotNet/Lesson06

答案 1 :(得分:2)

您需要执行命令;

conn.Open(); //Open the connection to the database
comm.ExecuteNonQuery(); //This line does the insert
conn.Close(); //Close the connection once your command executed.

还要考虑参数化查询并在using块中打开连接对象,以避免让连接对象保持打开状态。

实施例

using(SqlConnection conn = new SqlConnection("connectionString"))
{
   SqlCommand cmd = new SqlCommand("your query string with @para", conn);
   cmd.Parameters.AddWithValue("@para", "value");
   conn.Open();
   cmd.ExecuteNonQuery();

}

答案 2 :(得分:1)

执行Transact-SQL语句时,正确的方法是:

    private const string connection = @"Data Source=(LocalDB)\v11.0;AttachDbFilename=C:\Users\Matt\Documents\coffeeShop.mdf;Integrated Security=True;Connect Timeout=30";

    protected void SubmitBTN_Click(object sender, EventArgs e)
    {
        string query = "INSERT INTO Table (coffeeName, coffeeGrid, coffeeOrigin, coffeePrice, coffeeQty, coffeeRRP) VALUES (@name, @grid, @origin, @price, @qty, @rrp)";
        using(SqlConnection conn = new SqlConnection(connection))
        using(SqlCommand command = new SqlCommand(query, connection))
        {        

            String coffeeName = NameTXT.Text;
            String coffeeGrid = GrindTXT.Text;
            String coffeeOrigin = OriginTXT.Text;
            String coffeePrice = PriceTXT.Text;
            String coffeeQty = QuantityTXT.Text;
            String coffeeRRP = RRPTXT.Text;

            command.Parameters.AddWithValue("@name", coffeeName);
            command.Parameters.AddWithValue("@grid", coffeeGrid);
            command.Parameters.AddWithValue("@origin", coffeeOrigin);
            command.Parameters.AddWithValue("@price", coffeePrice);
            command.Parameters.AddWithValue("@qty", coffeeQty);
            command.Parameters.AddWithValue("@rrp", coffeeRRP);

            try
            {
                command.Connection.Open();
                command.ExecuteNonQuery();
            }
            catch (SqlException Ex)
            {

                console.WriteLine( "Error message: " + Ex);
            }
            finally
            {
                command.Connection.Close();
            }        

        }

    }

答案 3 :(得分:0)

您无法读取插入语句。您必须使用comm.executeNonQuery()执行insert命令,然后创建一个新的select语句来读取数据

答案 4 :(得分:0)

您需要执行SQL命令。在关闭连接之前,请添加:

comm.ExecuteNonQuery();

有关示例,请参阅MSDN: http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.executenonquery.aspx

相关问题