我在Visual Web Dev 2010 Express中使用C＃创建了一个Web窗体，它包含文本框/标签（基于复选框）但是当我运行代码时运行SQL命令失败。在使用3个文本框之前，我已经使代码工作，但在扩展代码时似乎无法工作。
我尝试过的事情：
当谷歌搜索有人说一些关于引号的问题（并且错误反映了这一点）但如果我从SQL命令中删除所有引用它就会失败，但我的想法是它始终必须是'"+datahere+"'是真？
我还会在错误下面引用我所有的代码，以获取有问题的网络表单。当我运行＆＃39; debug＆＃39;：
时，错误看起来像这样“＆＃39;”附近的语法不正确。 字符串后面的未闭合引号＆＃39;）＆＃39;。
描述：执行当前Web请求期间发生了未处理的异常。请查看堆栈跟踪以获取有关错误及其源自代码的位置的更多信息。
异常详细信息：System.Data.SqlClient.SqlException：语法不正确＆＃39; t＆＃39;。 字符串后面的未闭合引号＆＃39;）＆＃39;。
来源错误：
Line 40: }
Line 41: SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
Line 42: cmd.ExecuteNonQuery();
Line 43: con.Close();
Line 44: Label1.Visible = true;
源文件：C：\ Users \ MYNAME \ Documents \ Visual Studio 2010 \ Projects \ SicknessDBNewSite \ SicknessDBNewSite \ WebForm2.aspx.cs Line：42
堆栈追踪：
[SqlException (0x80131904): Incorrect syntax near 't'.
Unclosed quotation mark after the character string ')'.]
System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +1791910
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +5347106
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +546
System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +1693
System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) +869
System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +413
System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +163
SicknessDBNewSite.WebForm2.Button1_Click(Object sender, EventArgs e) in C:\Users\MYNAME\Documents\Visual Studio 2010\Projects\SicknessDBNewSite\SicknessDBNewSite\WebForm2.aspx.cs:42
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +9653178
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +103
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +10
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +13
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +35
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1724
代码背后： webform2.aspx
<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="WebForm2.aspx.cs" Inherits="SicknessDBNewSite.WebForm2" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
<style type="text/css">
.style1
{
width: 72%;
}
.style2
{
width: 443px;
}
.style3
{
text-align: center;
text-decoration: underline;
}
.style4
{
width: 443px;
height: 65px;
}
.style5
{
height: 65px;
}
.style6
{
text-align: center;
}
</style>
</head>
<body>
<form id="form1" runat="server">
<div style="text-align: center">
<h1 class="style3">
Test Form Submission
</h1>
<table class="style1" align="center">
<tr>
<td class="style2">
Name</td>
<td>
<asp:TextBox ID="txtname" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Grade</td>
<td>
<asp:TextBox ID="txtgrade" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Depot</td>
<td>
<asp:TextBox ID="txtdepot" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Nature of Illness?</td>
<td>
<asp:TextBox ID="txtillness" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Appointment made to see doctor (Yes or No)?</td>
<td>
<asp:RadioButton ID="RadioAppointmentYes" runat="server" Text="Yes" />
<asp:RadioButton ID="RadioAppointmentNo" runat="server" Text="No" />
<asp:Label ID="LabelAppointment" runat="server" Visible="False"></asp:Label>
</td>
</tr>
<tr>
<td class="style2">
Medication Taken (Yes or No)?</td>
<td class="style6">
<asp:RadioButton ID="RadioMedicationYes" runat="server" Text="Yes" />
<asp:RadioButton ID="RadioMedicationNo" runat="server" Text="No" />
<asp:Label ID="LabelMedication" runat="server" Visible="False"></asp:Label>
</td>
</tr>
<tr>
<td class="style2">
Expected length of absence?</td>
<td>
<asp:TextBox ID="txtabsence" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
If not contacted by staff member, who contacted on their behalf?</td>
<td>
<asp:TextBox ID="txtcontactby" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Likely resumption date?</td>
<td>
<asp:TextBox ID="txtresumedate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Contact telephone number</td>
<td>
<asp:TextBox ID="txtcontactnum" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Latest update date</td>
<td>
<asp:TextBox ID="txtupdate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style4">
Details</td>
<td class="style5">
<asp:TextBox ID="txtdetails" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Resumption Date</td>
<td>
<asp:TextBox ID="txtresumeddate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Detail</td>
<td>
<asp:TextBox ID="txtdetail" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Is the person still on medication at the time of resumption?</td>
<td>
<asp:TextBox ID="txtmedonreturn" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Controller / Planner's name</td>
<td>
<asp:TextBox ID="txtreporter" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Date of contact</td>
<td>
<asp:TextBox ID="txtdateofcontact" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Date and time of next shift</td>
<td>
<asp:TextBox ID="txtdatetimeshift" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
</td>
<td>
<asp:Button ID="Button1" runat="server" onclick="Button1_Click" Text="Submit" Width="100px" />
</td>
</tr>
</table>
</div>
<a href="http://INTRANET/webform1.aspx">
<asp:Label ID="Label1" runat="server" ForeColor="Green" Visible="False" /></asp:Label>
</a>
<asp:SqlDataSource ID="SqlDataSource1" runat="server"
ConnectionString="<%$ ConnectionStrings:ConnectionStringTestFormSubmission %>"
SelectCommand="SELECT * FROM [sicknesstest]"></asp:SqlDataSource>
</form>
</body>
</html>
webform2.aspx.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;
namespace SicknessDBNewSite
{
public partial class WebForm2 : System.Web.UI.Page
{
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionStringTestFormSubmission"].ConnectionString);
protected void Page_Load(object sender, EventArgs e)
{
con.Open();
}
protected void Button1_Click(object sender, EventArgs e)
{
if (RadioAppointmentYes.Checked)
{
LabelAppointment.Text = "Yes";
}
else if (RadioAppointmentNo.Checked)
{
LabelAppointment.Text = "No";
}
if (RadioMedicationYes.Checked)
{
LabelAppointment.Text = "Yes";
}
else if (RadioMedicationNo.Checked)
{
LabelAppointment.Text = "No";
}
SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+LabelAppointment.Text+"','"+LabelMedication.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
cmd.ExecuteNonQuery();
con.Close();
Label1.Visible = true;
Label1.Text = "Your Data has been stored successfully! Click here to view";
txtname.Text = "";
txtgrade.Text = "";
txtdepot.Text = "";
txtillness.Text = "";
txtabsence.Text = "";
txtcontactby.Text = "";
txtupdate.Text = "";
txtdetails.Text = "";
txtresumedate.Text = "";
txtdetail.Text = "";
txtmedonreturn.Text = "";
txtreporter.Text = "";
txtdateofcontact.Text = "";
txtresumeddate.Text = "";
}
}
}
- Datesource：
WebConfig：
数据库在我的计算机上本地运行，作为测试托架＆＃39;我的工作就找到了。
<add name="ConnectionStringTestFormSubmission" connectionString="Data Source=G00069-PC\SQLEXPRESS;Initial Catalog=SicknessDatabase;Persist Security Info=True;User ID=REMOVED;Password=REMOVED"
providerName="System.Data.SqlClient" />
答案 0 :(得分：6)
92.7％（a）的所有SQL执行问题都会变得明显。
您输入字段中某处可能存在杂散引号，不一定是恶意引用 - 可能是由oh no, we won't go或code doesn't work或contact Mr O'Rourke引起的。
这意味着做类似的事情：
string strcmd = "insert into ...";
// Examine/output strcmd here.
SqlCommand cmd = new SqlCommand(strcmd);
cmd.ExecuteNonQuery();
然后，一旦你开始工作，请查看两个术语＆＃34; SQL注入攻击＆＃34;和＃34; SQL准备语句＆＃34;。在某些时候，你会想要开始使用后者来阻止前者。
（a）图片从空气中拉出，实际值可能会有所不同： - ）
答案 1 :(得分：5)
我的建议是在查询中使用参数而不是连接。在sql查询中使用参数的示例如下：
IDbCommand command = conn.CreateCommand();
command.CommandText = "SELECT * FROM M_ITEM_SERIAL WHERE ITSR_PLANT_ID = @plantId";
IDbDataParameter plantIdParam = command.CreateParameter();
plantIdParam.ParameterName = "@plantId";
plantIdParam.Direction = ParameterDirection.Input;
plantIdParam.Value = plantId;
command.Parameters.Add(plantIdParam);
答案 2 :(得分：1)
尝试重建您的陈述。在c＃中，我永远不会像这样串联，请使用String.Format。通常，由于SQL注入，您甚至不应该以这种方式将参数传递给数据库。尝试使用SqlParameter。
我认为您的问题是由于某些文本框中的值错误而导致的，当您使用SqlParameter时，这种情况不会发生。
您应该阅读此SO-Answer：Inserting values into a SQL Server database using ado.net via C#