Question

以下是用于将datagridview项输入表中的代码。

    Dim X As DataGridViewRow

    grnno = 123123
    glocation = txtlocation.Text
    gsupplier = txtsupplier.Text
    greceivedby = txtreceivedby.Text
    greceiveddate = txtreceiveddate.Text
    grn_status = cmbstatus.SelectedItem
    ggrossamt = txtgrossamt.Text
    gdiscountamount = txtdiscount.Text
    gtotalnetamount = txttotalnet.Text
    sqlstr = "INSERT INTO POS_GRN_HDR(loc_code,supplier_code,created_by,created_Date,grn_status,gross_amt,disc_Amt,net_Amt) values('" & glocation & "','" & gsupplier & "','" & greceivedby & "','" & greceiveddate & "','" & grn_status & "'," & ggrossamt & "," & gdiscountamount & "," & gtotalnetamount & " )"
    sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
    sqlcmd.ExecuteNonQuery()
    For Each X In datagridItems.Rows

        sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "','" & X.Cells(6).Value & "','" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"
        sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
        sqlcmd.ExecuteNonQuery()
    Next

错误是在第二个插入语句中，它给出了错误，无法将字符串转换为整数..来自x.cell（6）的单元格是整数类型，而数据库中的单元格也是整数类型，现在我想问我应该用单引号将其括起来，因为单引号中包含语法''和双引号等错误，就像无法将字符串转换为int类型一样。请告诉我哪里做错了。

Answer 1

首先使用参数化查询！它更安全，更易读。您将一些值作为字符串传递，但应该是整数。

sqlstr = "INSERT INTO POS_GRN_HDR(loc_code,supplier_code,created_by,created_Date,grn_status,gross_amt,disc_Amt,net_Amt) _
values(@glocation, @gsupplier, @greceivedby, @greceiveddate, @grn_status, @ggrossamt, @gdiscountamount, @gtotalnetamount)"

sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
sqlcmd.Parameters.AddWithValue("@glocation", glocation) 
sqlcmd.Parameters.AddWithValue("@gsupplier", gsupplier) //and so on


For Each X In datagridItems.Rows

  sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) _
            VALUES(@grnno, @item_code, @description, ...)"

  sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
  sqlcmd.Parameters.AddWithValue("@grnno", grnno)
  sqlcmd.Parameters.AddWithValue("@item_code", CType(X.Cells(0).Value, Integer)) //cast to proper type      

  sqlcmd.ExecuteNonQuery()

Next

Answer 2

删除单引号''

例如（根据您的帖子仅指x.cell（6））使用" & X.Cells(6).Value & "

    sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "', " & X.Cells(6).Value & ",'" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"

您可能还需要cast it（假设它始终具有数值）

" & CInt(X.Cells(6).Value) &"

我假设您知道SQL注入，这种更新数据库的方法现在通常是“过时的”和“不良做法”，而您should use parameters instead ...

<强>更新

由于存在null的可能性（并且你希望它在这种情况下为0），你可以使用类似的东西（未经测试，因为我不是VB人）

dim cellSix as integer
if IsNothing(X.Cells(6).Value then 
    cellSix = 0
else
    cellSix = CInt(X.Cells(6).Value)
end if

sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "', " & cellSix & ",'" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"

或者，为了缩短代码，您可以使用IIF

cellSix = IIf(isnothing(CInt(X.Cells(6).Value)), 0,  CInt(X.Cells(6).Value))

插入语句错误vb.net

2 个答案: