Question

我在文本框的所有输入中都出现语法错误。

在我的数据库中，所有要求都是字符串而不是ID，这是一个自动编号，我尝试搜索可能的答案，但都没有用，或者我只是错过了一些答案

这是错误：

查询表达式''hasdasd'password中的语法错误（缺少运算符） ='h'account_Type ='Manager'Name ='h'Middle_Name ='h'Surname'h'address'h'BirthDate ='3/17 / 1999'Mobile_Number'65465''。

代码：

private void update_Click(object sender, EventArgs e)
{
    DateTime bdate = DateTime.Parse(birthdate.Value.ToShortDateString());
    DateTime currentDate = DateTime.Parse(DateTime.Now.Date.ToShortDateString());

    int age = currentDate.Year - bdate.Year;
    String id = emp_view.SelectedRows[0].Cells[0].Value + String.Empty;
    int id1 = Int32.Parse(id);

    try
    {
        OleDbConnection con = new OleDbConnection();
        con.ConnectionString = @"Provider = Microsoft.ACE.OLEDB.12.0; Data Source = C:\dbms\jollibee.accdb";
        con.Open();

        OleDbCommand cmd = new OleDbCommand();
        cmd.Connection = con;
        cmd.CommandText = "update Employee_Details set username = '" + username.Text +
                                                            "'password = '" + password.Text +
                                                            "'account_Type='" + accountType.Text +
                                                            "'Name='" + name.Text +
                                                            "'Middle_Name='" + middlename.Text +
                                                            "'Surname'" + surname.Text +
                                                            "'address'" + address.Text +
                                                            "'BirthDate='" + birthdate.Value.ToShortDateString() +
                                                            "'Mobile_Number'" + mobilenumber.Text +
                                                            "'where ID = '" + id1 + "'";

        if (username.Text.Equals("") ||
            username.Text.Equals("") ||
            password.Text.Equals("") ||
            middlename.Text.Equals("") ||
            surname.Text.Equals("") ||
            address.Text.Equals("") ||
            accountType.Text.Equals("") ||
            mobilenumber.Text.Equals("")
           )
        {
            MessageBox.Show("Please fill all fields.");
            con.Close();
        }
        else if (age < 18)
        {
            MessageBox.Show("You are not allowed to work because you are under age..");
            con.Close();
        }
        else
        {
            cmd.ExecuteNonQuery();
            con.Close();
            MessageBox.Show(username.Text + "is now updated on database.");
            list();
        }
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message);
    }
}

Answer 1

在现有代码中，存在类似的问题。

1-更新中的列不以＆＃34;，＆＃34;

分隔

2-所有字符串不使用引号''

分隔

您应始终避免通过串联串联来内联编写查询。这将使您的代码容易受到 SQL注入。

的攻击

要详细了解 SQL注入，请检查here

使用命令参数更改您的代码。

cmd.CommandText = "update Employee_Details set [username] = @un, [password] = @pw, [account_Type]= @at, [Name] = @nm, [Middle_Name]= @mn, [Surname]= @sn, [address]= @add, [BirthDate] = @bd, [Mobile_Number] = @mn WHERE [Id]=@id";
cmd.Parameters.Add("@un", OleDbType.VarChar).Value = username.Text;
cmd.Parameters.Add("@pw", OleDbType.VarChar).Value = password.Text;
cmd.Parameters.Add("@at", OleDbType.VarChar).Value = accountType.Text;
cmd.Parameters.Add("@nm", OleDbType.VarChar).Value = name.Text;
cmd.Parameters.Add("@mn", OleDbType.VarChar).Value = middlename.Text;
cmd.Parameters.Add("@sn", OleDbType.VarChar).Value = surname.Text;
cmd.Parameters.Add("@add", OleDbType.VarChar).Value = address.Text;
cmd.Parameters.Add("@bd", OleDbType.Date).Value = Convert.ToDateTime(birthdate.Value);
cmd.Parameters.Add("@mn", OleDbType.VarChar).Value = mobilenumber.Text;
cmd.Parameters.Add("@id", OleDbType.VarChar).Value = id1;

注意：您需要根据您现在知道的表结构更正数据类型。

Answer 2

您的完全格式错误的 SQL应如下所示：

       cmd.CommandText = "update Employee_Details set " +
                         "username = '" + username.Text + "',"+
                         "[password] = '" + password.Text + "'," +
                         "account_Type = '" + accountType.Text + "'," +
                         "[Name] = '" + name.Text + "'," +
                         "Middle_Name = '" + middlename.Text + "'," +
                         "Surname = '" + surname.Text + "'," +
                         "address = '" + address.Text + "'," +
                         "BirthDate = #" + birthdate.Value.ToString("yyyy'/'MM'/dd") + "#," +
                         "Mobile_Number = '" + mobilenumber.Text + "' " +
                         "where ID = " + id1 + "";

那就是说，DO使用已经解释过的参数。更容易和更安全。

语法错误缺少查询表达式c＃中的运算符使用访问作为数据库

2 个答案: