0

我的任务是建立一个基本的数据库驱动的电子商务网站。我有一个主页、一个产品页面、一个订单页面、一个订单确认页面、一个购物车页面和一个查看当前订单页面。该站点使用具有三个表的 Access 数据库。

包含所有客户详细信息的客户表（FirstName、LastName、EmailAdd、CardNo、CardEx、SortCode、DeliveryAdd、Postcode）

Products 表，包含所有产品信息（ProductID、ProductName、Price、ProductType、Images、ProductDescription）。

还有一个包含 CustomerID 和 ProductID 的 Orders 表。

我正在尝试在订单页面上创建一个 INSERT 语句，以便当客户插入他们的详细信息并按下提交按钮时，客户表将插入一条新记录。我还希望它在订单表中创建一个条目，并将客户端重定向到订单确认页面，该页面将显示订单的详细信息。

这是我在订单上单击提交按钮时运行的代码。

编辑我已经修复了缺少撇号的错误。尝试使用两个 sql 命令插入，因为我被告知 access 数据库不能同时处理两个。虽然仍然出现错误。

  Protected Sub btnAddRecord_Click(ByVal sender As Object, ByVal e As System.EventArgs)

    Dim strFirstName As String
    Dim strLastName As String
    Dim strEmailAdd As String
    Dim intCardNo As String
    Dim strCardEx As String
    Dim intSortCode As String
    Dim strDeliveryAdd As String
    Dim strPostCode As String
    Dim intProductID As Integer
    strFirstName = tbxFirstName.Text
    strLastName = tbxLastName.Text
    strEmailAdd = tbxEmailAdd.Text
    intCardNo = tbxCardNo.Text
    strCardEx = tbxCardEx.Text
    intSortCode = tbxSortCode.Text
    strDeliveryAdd = tbxDeliveryAdd.Text
    strPostCode = tbxPostcode.Text
    intProductID = ddlProduct.SelectedValue
    
    Dim strDatabaseNameAndLocation As String
    strDatabaseNameAndLocation = Server.MapPath("KingToots.mdb")
    Dim strSQLCommand As String
    strSQLCommand = "INSERT INTO Customer(FirstName, LastName, EmailAdd, CardNo, CardEx, SortCode, DeliveryAdd, Postcode) " & _
        "Values ('" & strFirstName & "', '" & strLastName & "', '" & strEmailAdd & "', '" & intCardNo & "', '" & strCardEx & "', '" & intSortCode & "', '" & strDeliveryAdd & "', '" & strPostCode & "');"
    Dim objOleDbConnection As System.Data.OleDb.OleDbConnection
    objOleDbConnection = New System.Data.OleDb.OleDbConnection("Provider=Microsoft.Jet.Oledb.4.0; Data Source=" & strDatabaseNameAndLocation)
    objOleDbConnection.Open()
    Dim objOleDbCommand As System.Data.OleDb.OleDbCommand
    objOleDbCommand = New System.Data.OleDb.OleDbCommand(strSQLCommand, objOleDbConnection)
    objOleDbCommand.ExecuteNonQuery()
    objOleDbConnection.Close()
    strSQLCommand = "INSERT INTO Orders(ProductID) " & "Values ('" & intProductID & "');"
    objOleDbConnection = New System.Data.OleDb.OleDbConnection("Provider=Microsoft.Jet.Oledb.4.0; Data Source=" & strDatabaseNameAndLocation)
    objOleDbConnection.Open()
    objOleDbCommand = New System.Data.OleDb.OleDbCommand(strSQLCommand, objOleDbConnection)
    objOleDbCommand.ExecuteNonQuery()
    objOleDbConnection.Close()
    strSQLCommand = "SELECT Customer.* FROM Customer ORDER BY Customer.CustomerID DESC;"
    objOleDbConnection = New System.Data.OleDb.OleDbConnection("Provider=Microsoft.Jet.Oledb.4.0; Data Source=" & strDatabaseNameAndLocation)
    objOleDbConnection.Open()
    objOleDbCommand = New System.Data.OleDb.OleDbCommand(strSQLCommand, objOleDbConnection)
    Dim objOleDbDataReader As System.Data.OleDb.OleDbDataReader
    objOleDbDataReader = objOleDbCommand.ExecuteReader()
    Dim datDataTable As System.Data.DataTable
    datDataTable = New System.Data.DataTable()
    datDataTable.Load(objOleDbDataReader)
    objOleDbConnection.Close()
    tbxFirstName.Text = ""
    tbxLastName.Text = ""
    tbxEmailAdd.Text = ""    
    tbxCardNo.Text = ""
    tbxCardEx.Text = ""
    tbxSortCode.Text = ""
    tbxDeliveryAdd.Text = ""
    tbxPostcode.Text = ""

End Sub
4

2 回答 2

1

您缺少此行末尾的右引号：

strSQLCommand = "INSERT INTO Customer(FirstName, LastName, EmailAdd, CardNo, CardEx, SortCode, DeliveryAdd, Postcode) " & _
    "Values ('" & strFirstName & "', '" & strLastName & "', '" & strEmailAdd & "', '" & intCardNo & "', '" & strCardEx & "', '" & intSortCode & "', '" & strDeliveryAdd & "', '" & strPostCode & ");"

关于明显的 SQL 注入问题，切换到参数将是最好的方法（如果这样做，您将永远不会遇到原始问题，参数不使用引号），但至少在您的要替换的字符串'，''因此如果您有一个叫 O'Neil 的客户，您的程序就不会死掉。

于 2012-05-04T17:40:54.487 回答
0

He is correct, you don't want to do this you will get sql injection. But here is the solution to your problem anyway.

The problem is not in the last sql statement but in the previous one.

'" & strPostCode & " is missing the last single quote.

it should read:

'" & strPostCode & "');

于 2012-05-04T17:46:56.497 回答