c# - 它说 command.ExecuteNonQuery() 没有初始化

Question

我的代码：

// Get Connection String
string conn = WebConfigurationManager.ConnectionStrings["GraduatesConnectionString"].ToString();
// Create connection object
SqlConnection connection = new SqlConnection(conn);
SqlCommand command = connection.CreateCommand();
try
{
    // Open the connection.
    connection.Open();
    // Execute the insert command.
    command.CommandText = ("INSERT INTO PersonalInfo(Id,Name,LastName,ContactNumber, Address,Gender, Date_Of_Birth) VALUES(\'"
                + (this.txtID.Text + ("\',\'"
                + (this.txtName.Text + ("\',\'"
                + (this.txtLastName.Text + ("\',\'"
                + (this.txtContactNumber.Text + ("\',\'"
                + (this.txtAddress.Text + ("\',\'"
                + (this.gender + ("\',\'"
                + (this.txtDateofBirth.Text + ("\',\'"
             )))));
    command.ExecuteNonQuery();
}
finally
{
    // Close the connection.
    connection.Close();
}

Answer 1

using (SqlConnection connection = new SqlConnection(connectionString))
using (SqlCommand command = connection.CreateCommand())
{
    command.CommandText = "INSERT INTO PersonalInfo (Id, Name, LastName, ContactNumber, Address, Gender, Date_Of_Birth) VALUES (@Id, @Name, @LastName, @LastName, @Address, @Gender, @DateOfBirth)";

    command.Parameters.AddWithValue("@Id", txtID.Text);
    ...

    connection.Open();
    command.ExecuteNonQuery();
}

Answer 2

您缺少结束语)，txtDateofBirth因此您的陈述不完整。

但请注意@podiluska 的评论。这段代码真的很容易被滥用。假设我在中输入类似以下文本的内容txtDateofBirth：

;DROP TABLE PersonalInfo;

然后您会收到如下查询：

INSERT INTO PersonalInfo(...)
VALUES (...);DROP TABLE PersonalInfo;

所以请使用@abatishchev 描述的参数化查询。

Answer 3

我很想将您的代码更改为：

string conn = WebConfigurationManager.ConnectionStrings["GraduatesConnectionString"].ToString();
// Create connection object
using(SqlConnection connection = new SqlConnection(conn))
{
    string queryText = "INSERT INTO PersonalInfo(Id,Name,LastName,ContactNumber, Address,Gender, Date_Of_Birth) VALUES(@id,@name,@lastName,@contactNumber, @address,@gender, @date_Of_Birth)";

    using(SqlCommand command = new SqlCommand(queryText, connection))
    {
        try
        {
            // Open the connection.
            connection.Open();

            command.Parameters.AddWithValue("@id", this.txtID.Text);
            command.Parameters.AddWithValue("@name", this.txtName.Text);
            command.Parameters.AddWithValue("@lastName", this.txtLastName.Text);
            command.Parameters.AddWithValue("@contactNumber", this.txtContactNumber.Text);
            command.Parameters.AddWithValue("@address", this.txtAddress.Text);
            command.Parameters.AddWithValue("@gender",this.gender );
            command.Parameters.AddWithValue("@date_Of_Birth", this.txtDateofBirth.Text);
            command.ExecuteReader();
        }
        finally
        {   
            // Close the connection.
            if(connection.State != ConnectionState.Closed)
                connection.Close();
        }
    }
}