3

大家晚上好

我正在使用以下内容尝试更新我的 MySQL 数据库中的记录，但记录没有被更新，我也没有发现任何异常。您的帮助将不胜感激：

dbConn = New MySqlConnection("Server=" & FormLogin.ComboBoxServerIP.SelectedItem & ";Port=3306;Uid=trojan;Password=horse;Database=accounting")
    Try
        If dbConn.State = ConnectionState.Open Then
            dbConn.Close()
        Else
            Try
                dbConn.Open()
                Dim dbAdapter As New MySqlDataAdapter("UPDATE customer " & _
                                                      "SET accountNumber= '" & TextBoxAccount.Text & "', nameLAST='" & TextBoxLastName.Text & "', nameFIRST='" & TextBoxFirstName.Text & "'" & _
                                                      "nameSALUTATION='" & ComboBoxSalutation.SelectedItem & "', nameCOMPANY='" & TextBoxCompanyName.Text & "', addressSTREET='" & TextBoxAddress1.Text & "'" & _
                                                      "addressSTREET1='" & TextBoxAddress2.Text & "', addressCITY='" & TextBoxCity.Text & "', addressSTATE='" & ComboBoxState.SelectedItem & "'" & _
                                                      "addressZIPCODE='" & MaskedTextBoxZip.Text & "', phone='" & MaskedTextBoxPhone.Text & "', fax='" & MaskedTextBoxFax.Text & "', email='" & TextBoxEmail.Text & "'" & _
                                                      "WHERE accountNumber='" & TextBoxAccount.Text & "';", dbConn)
            Catch ex As Exception
                MessageBox.Show("A DATABASE ERROR HAS OCCURED" & vbCrLf & vbCrLf & ex.Message & vbCrLf & _
                            vbCrLf + "Please report this to the IT/Systems Helpdesk at Ext 131.")
            End Try
            MessageBox.Show("Customer account SUCCESSFULLY updated!")
            Call lockForm()
        End If
    Catch ex As Exception
        MessageBox.Show("A DATABASE ERROR HAS OCCURED" & vbCrLf & vbCrLf & ex.Message & vbCrLf & _
                            vbCrLf + "Please report this to the IT/Systems Helpdesk at Ext 131.")
    End Try
    Call lockForm()
    dbConn.Close()
4

2 回答 2

3

使用MySQLCommand而不是MySQLDataAdapter. 您违背了使用 ADONet 的目的，因为您的代码仍然容易受到 sql 注入的攻击。使其参数化。以下是您的代码中的修改代码。它Using-End Using用于正确处理对象处置。

Dim ConnectionString As String ="Server=" & FormLogin.ComboBoxServerIP.SelectedItem & ";Port=3306;Uid=trojan;Password=horse;Database=accounting"
Dim iQuery As String = "UPDATE customer " & _
                       "SET accountNumber = @accountNumber, nameLAST = @nameLAST, nameFIRST = @nameFIRST, " & _
                       "    nameSALUTATION = @nameSALUTATION, nameCOMPANY = @nameCOMPANY, addressSTREET = @addressSTREET, " & _
                       "    addressSTREET1 = @addressSTREET1, addressCITY = @addressCITY, addressSTATE =  @addressSTATE, " & _
                       "    addressZIPCODE = @addressZIPCODE, phone = @phone, fax = @fax, email = @email               " & _
                       "WHERE accountNumber = @accountNumber"

Using dbConn As New MySqlConnection(ConnectionString)
    Using dbComm As New MySQLCommand()
        With dbComm
            .Connection = dbConn
            .CommandType = CommandType.Text
            .CommandText = iQuery
            .Parameters.AddWithValue("@accountNumber", TextBoxAccount.Text )
            .Parameters.AddWithValue("@nameLAST", TextBoxLastName.Text)
            .Parameters.AddWithValue("@nameFIRST", TextBoxFirstName.Text)
            .Parameters.AddWithValue("@nameSALUTATION", ComboBoxSalutation.SelectedItem)
            .Parameters.AddWithValue("@nameCOMPANY", TextBoxCompanyName.Text)
            .Parameters.AddWithValue("@addressSTREET", TextBoxAddress1.Text)
            .Parameters.AddWithValue("@addressSTREET1", TextBoxAddress2.Text)
            .Parameters.AddWithValue("@addressCITY", TextBoxCity.Text)
            .Parameters.AddWithValue("@addressSTATE", ComboBoxState.SelectedItem)
            .Parameters.AddWithValue("@addressZIPCODE", MaskedTextBoxZip.Text)
            .Parameters.AddWithValue("@phone", MaskedTextBoxPhone.Text)
            .Parameters.AddWithValue("@fax", MaskedTextBoxFax.Text)
            .Parameters.AddWithValue("@email", TextBoxEmail.Text)
        End With
        Try
            dbConn.Open
            dbComm.ExecuteNonQuery()

            MessageBox.Show("Customer account SUCCESSFULLY updated!")
            Call lockForm()
        Catch( ex as MySQLException)
            MessageBox.Show("A DATABASE ERROR HAS OCCURED" & vbCrLf & vbCrLf & ex.Message & vbCrLf & _
                                vbCrLf + "Please report this to the IT/Systems Helpdesk at Ext 131.")
        Finally
            dbConn.Close()
        End Try
    End Using
End Using
于 2012-09-14T00:41:06.603 回答
1

在这种情况下，我会使用ExecuteNonQuery，因为您不能以您尝试使用它的方式使用 MySQLDataAdapter。另外请使用参数，因为您正在做的事情会使您面临 SQL 注入攻击。最后，您不需要更新 accountNumber，因为您正在使用它来查找要更新的行！

于 2012-09-13T22:36:32.850 回答