0

每次插入后，我都会在事件查看器中获取日志。数据被插入，但由于它在一段时间后淹没了事件查看器，直到我清理了日志，服务才会启动。

这是我在日志中得到的：

XY.Archive.SQLClassLibrary.DalException: Problem accessing database. ---> System.Data.SqlClient.SqlException: Incorrect syntax near '_3'.
Unclosed quotation mark after the character string ',308387,null)'.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
   at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
   at System.Data.SqlClient.SqlDataReader.ConsumeMetaData()
   at System.Data.SqlClient.SqlDataReader.get_MetaData()
   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method)
   at System.Data.SqlClient.SqlCommand.ExecuteScalar()
   at XY.Archive.SQLClassLibrary.SQLDataAccessLogic.ExecuteCommand(String sqlString)
   --- End of inner exception stack trace ---
   at XY.Archive.SQLClassLibrary.SQLDataAccessLogic.ExecuteCommand(String sqlString)
   at XY.Archive.ServerEngine.Server.InsertDocumentIntoDatabase(Document documentOriginal, Int32 archiveID, String tableName)
Sql string: INSERT INTO table (columns) values (bunch of values) select @@Identity

这是插入语句的创建方式：

Public Shared Function CreateStringForInsertDocument(ByVal tableName As String, ByVal document As Document, ByVal strArchiveTime As String, ByVal indexFieldNames As String, ByVal indexFieldValues As String) As String
    Dim strInsert As String = "INSERT INTO " & tableName & " (GUID, ContainerID, DocumentStatusID, ArchiveTime, " & indexFieldNames & ") values ('" & document.GUID & "' ," & document.Container.ContainerID & "," & document.DocumentStatusID & ",'" & strArchiveTime & "'," & indexFieldValues & ") select @@Identity"
    Return strInsert
End Function

有人知道可能导致问题的原因吗？

4

1 回答 1

3

是的。原因是您没有使用参数化查询。仔细阅读它们，注意“SQL注入”这个短语

于 2012-09-21T10:30:54.350 回答