Question

“这是代码。当我尝试插入时，我不断收到异常。它说...查询表达式中的语法错误（缺少运算符）'Mary'，'Smith'，'Jane'，'2 oak'，'辛辛那提”， 'OH'， '45220'， '413-3222'， '15'。“

    mySQL = "Insert into Team
              ([Player Number],
               [First Name], 
               [Last Name], 
               [Parent Name], 
               [Address] , 
               [City], 
               [State], 
               [Zip Code], 
               [Telephone Number], 
               [Age]) 
          values (" _
               & intPlayerNo & "," _
               & strFirstName & "','" _
               & strLastName & "','" _
               & strParentName & "','" _
               & strAddress & "','" _
               & strCity & "','" _
               & strState & "','" _
               & strZipCode & "','" _
               & strPhone & "','" _
               & intAge & ")"

Answer 1

这是构建SQL查询的一种相当错误的方法。您想在查询中使用参数

mySQL = "Insert into Team([Player Number]) values (@playerNumber)"
Using connection As New SqlConnection(connectionString)
Dim command As New SqlCommand(mySQL, connection)
command.Parameters.AddWithValue("@playerNumber", intPlayerNo)

等等。如果你不这样做，你就会对sql注入等各种各样的肮脏行为持开放态度，更不用说你已经遇到了类似错误的错误。

Answer 2

你在strFirstname之前缺少一个引号。应该是

& intPlayerNo & ",'" _
& strFirstName & "','" _

你应该在intAge之前删除最后一个单引号，所以它应该是：

& strPhone & "'," _
& intAge & ")"

Answer 3

尝试：

mySQL = "Insert into Team([Player Number], [First Name], [Last Name], [Parent Name], [Address] , [City], [State], [Zip Code], [Telephone Number], [Age]) values (" _
           & intPlayerNo & ",'" _
           & strFirstName & "','" _
           & strLastName & "','" _
           & strParentName & "','" _
           & strAddress & "','" _
           & strCity & "','" _
           & strState & "','" _
           & strZipCode & "','" _
           & strPhone & "'," _
           & intAge & ")"

错过了两个'的样子。

任何人都可以在此代码中找出我的语法有什么问题吗？

3 个答案: