Question

因此，Visual Studio告诉我在更新语句中我的引号不正确。我觉得它可能不止于此。我觉得我很接近但是在这个sql语句中我没有看到我出错的地方。网页的目的是更新此步骤的全部数据库。有人可以帮我吗。

这是我的代码。

P.S。 - 我做了一个类似于此的insert语句，但字符串idString部分一直到softwareReportRecord.Close（）;在更新声明之下并且它有效。

    using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
public partial class _Default : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        reportDateText.Text = DateTime.Today.ToShortDateString();
        //code page 429
        if (Page.IsPostBack)
        {
            Page.Validate();
            if (Page.IsValid)
            {

                bugReportForm.Visible = false;
                regMessage.Visible = true;
                string typeOS = oSListbox.SelectedValue;
                string reportDate = reportDateText.Text;
                string hardware = hardwareText.Text;
                string occurrence = occurrenceRadioButtonList.SelectedValue;
                string shortDescription = shortDescriptionText.Text;
                string longDescription = longDescriptionText.Text;
                string actionsTaken = actionsTakenText.Text;
                SqlConnection dbConnection = new SqlConnection("Data Source=.\\SQLEXPRESS;Integrated Security=true");
                try
                {
                    dbConnection.Open();
                    dbConnection.ChangeDatabase("BugsReport");

                }
                catch (SqlException exception)
                {
                    if (exception.Number == 911)
                    {
                        SqlCommand sqlCommand = new SqlCommand("CREATE DATABASE BugsReport", dbConnection);
                        sqlCommand.ExecuteNonQuery();
                        regMessage.Text = "<p>Successfully created the database.</p>";
                        dbConnection.ChangeDatabase("BugsReport");
                    }
                    else
                        Response.Write("<p>Error code " + exception.Number
                            + ": " + exception.Message + "</p>");
                }
                finally
                {
                    regMessage.Text += "<p>Successfully selected the database.</p>";
                }
                try
                {
                    string SQLString = "SELECT * FROM softwareLog";
                    SqlCommand checkIDTable = new SqlCommand(SQLString, dbConnection);
                    SqlDataReader idRecords = checkIDTable.ExecuteReader();
                    idRecords.Close();
                }
                catch (SqlException exception)
                {
                    if (exception.Number == 208)
                    {
                        SqlCommand sqlCommand = new SqlCommand("CREATE TABLE softwareLog (reportID SMALLINT IDENTITY(100,1) PRIMARY KEY, typeOS VARCHAR(25), reportDate DATE, hardware VARCHAR(50), occurrence VARCHAR(15), shortDescription VARCHAR(100), longDescription VARCHAR(500), actionsTaken VARCHAR(25))", dbConnection);
                        sqlCommand.ExecuteNonQuery();
                        regMessage.Text += "<p>Successfully created the table.</p>";
                    }
                    else
                        regMessage.Text += "<p>Error code " + exception.Number
                            + ": " + exception.Message + "</p>";
                }
                finally
                {
                    string idString = "SELECT IDENT_CURRENT('softwareLog') AS reportID";
                SqlCommand newID = new SqlCommand(idString, dbConnection);
                SqlDataReader softwareReportRecord = newID.ExecuteReader();
                softwareReportRecord.Read();
                string reportID = Convert.ToString(softwareReportRecord["reportID"]);
                softwareReportRecord.Close();

                string editRecord = "UPDATE softwareLog SET "
            + "typeOS='" + typeOS + "', "
            + "reportDate='" + reportDate + "', "
            + "hardware='" + hardware + "' "
            + "occurrence='" + occurrence + "' "
            + "shortDescription='" + shortDescription + "' "
            + "longDescription='" + longDescription + "' "
            + "actionsTaken='" + actionsTaken + "' "
            + "WHERE reportID=" + reportID + ";";



                    SqlCommand sqlCommand = new SqlCommand(editRecord, dbConnection);
                    sqlCommand.ExecuteNonQuery();
                }


                dbConnection.Close();
            }
        }
    }
}




finally
                {
                    string addRecord = "INSERT INTO softwareLog VALUES('"
                        + typeOS + "', '"
                        + reportDate + "', '"
                        + hardware + "', '"
                        + occurrence + "', '"
                        + shortDescription + "', '"
                        + longDescription + "', '"
                        + actionsTaken + "')";

                    SqlCommand sqlCommand = new SqlCommand(addRecord, dbConnection);
                    sqlCommand.ExecuteNonQuery();
                }
                string idString = "SELECT IDENT_CURRENT('softwareLog') AS reportID";
                SqlCommand newID = new SqlCommand(idString, dbConnection);
                SqlDataReader softwareReportRecord = newID.ExecuteReader();
                softwareReportRecord.Read();
                string reportID = Convert.ToString(softwareReportRecord["reportID"]);
                softwareReportRecord.Close();
                regMessage.Text += "<p>Sorry for your inconvience. We will be working on your problem ASAP.  For reference your ID is  </p>" + reportID;

                dbConnection.Close();

Answer 1

你在更新中遗失了太多“，”。编辑您在字符串中有单引号。你还需要逃避这些引用：

string editRecord = "UPDATE softwareLog SET "
    + "typeOS='" + typeOS.Replace("'", "''") + "', "
    + "reportDate='" + reportDate + "', "
    + "hardware='" + hardware.Replace("'", "''") + "',"
    + "occurrence='" + occurrence.Replace("'", "''") + "',"
    + "shortDescription='" + shortDescription.Replace("'", "''") + "',"
    + "longDescription='" + longDescription + "',"
    + "actionsTaken='" + actionsTaken.Replace("'", "''") + "'"
    + "WHERE reportID= " + reportID ;

在插入中，您不需要reportID的引用：

string addRecord = "INSERT INTO softwareLog VALUES('"
    + typeOS.Replace("'", "''") + "', '"
    + reportDate + "', '"
    + hardware.Replace("'", "''") + "', '"
    + occurrence.Replace("'", "''") + "', '"
    + shortDescription.Replace("'", "''") + "', '"
    + longDescription.Replace("'", "''") + "', '"
    + actionsTaken.Replace("'", "''") + "')";

Answer 2

传递给查询的数据可能是提前终止字符串。由于许多原因（包括这一个，还有SQL注入），您应该使用参数而不是连接。

Answer 3

试试这个，

 string editRecord = "UPDATE softwareLog SET "
          + "typeOS='" + typeOS + "', "
          + "reportDate='" + reportDate + "', "
          + "hardware='" + hardware + "',"
          + "occurrence='" + occurrence + "',"
          + "shortDescription='" + shortDescription + "',"
          + "longDescription='" + longDescription + "',"
          + "actionsTaken='" + actionsTaken + "'"
          + "WHERE reportID=" + reportID + "";

您能否也请添加您的插入声明。

备注：最好使用Parametrized SqlCommand或Store 执行此类操作的过程。

如果您为'任何字段提供价值，那么它将无效。同时检查您为ReportId提供的值。

Answer 4

在此示例中，您应该使用参数作为SQL注入的预防措施，正如其他人所提到的那样。

但对于其他字符串，我建议您查看string.Format（）而不是连接所有内容。会使这个字符串更容易阅读。

更新数据库

4 个答案: