0

所以 Visual Studio 告诉我我的引用在更新语句中是不正确的。我觉得可能不止这些。我觉得我很接近,但我看不出在这个 sql 语句中我哪里出错了。网页的重点是更新数据库,这一切都是为了这一步。有人可以帮我吗。

这是我的代码。

PS - 我做了一个与此类似的插入语句,但字符串 idString 部分一直到 softwareReportRecord.Close(); 位于更新声明下方,并且有效。

    using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
public partial class _Default : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        reportDateText.Text = DateTime.Today.ToShortDateString();
        //code page 429
        if (Page.IsPostBack)
        {
            Page.Validate();
            if (Page.IsValid)
            {

                bugReportForm.Visible = false;
                regMessage.Visible = true;
                string typeOS = oSListbox.SelectedValue;
                string reportDate = reportDateText.Text;
                string hardware = hardwareText.Text;
                string occurrence = occurrenceRadioButtonList.SelectedValue;
                string shortDescription = shortDescriptionText.Text;
                string longDescription = longDescriptionText.Text;
                string actionsTaken = actionsTakenText.Text;
                SqlConnection dbConnection = new SqlConnection("Data Source=.\\SQLEXPRESS;Integrated Security=true");
                try
                {
                    dbConnection.Open();
                    dbConnection.ChangeDatabase("BugsReport");

                }
                catch (SqlException exception)
                {
                    if (exception.Number == 911)
                    {
                        SqlCommand sqlCommand = new SqlCommand("CREATE DATABASE BugsReport", dbConnection);
                        sqlCommand.ExecuteNonQuery();
                        regMessage.Text = "<p>Successfully created the database.</p>";
                        dbConnection.ChangeDatabase("BugsReport");
                    }
                    else
                        Response.Write("<p>Error code " + exception.Number
                            + ": " + exception.Message + "</p>");
                }
                finally
                {
                    regMessage.Text += "<p>Successfully selected the database.</p>";
                }
                try
                {
                    string SQLString = "SELECT * FROM softwareLog";
                    SqlCommand checkIDTable = new SqlCommand(SQLString, dbConnection);
                    SqlDataReader idRecords = checkIDTable.ExecuteReader();
                    idRecords.Close();
                }
                catch (SqlException exception)
                {
                    if (exception.Number == 208)
                    {
                        SqlCommand sqlCommand = new SqlCommand("CREATE TABLE softwareLog (reportID SMALLINT IDENTITY(100,1) PRIMARY KEY, typeOS VARCHAR(25), reportDate DATE, hardware VARCHAR(50), occurrence VARCHAR(15), shortDescription VARCHAR(100), longDescription VARCHAR(500), actionsTaken VARCHAR(25))", dbConnection);
                        sqlCommand.ExecuteNonQuery();
                        regMessage.Text += "<p>Successfully created the table.</p>";
                    }
                    else
                        regMessage.Text += "<p>Error code " + exception.Number
                            + ": " + exception.Message + "</p>";
                }
                finally
                {
                    string idString = "SELECT IDENT_CURRENT('softwareLog') AS reportID";
                SqlCommand newID = new SqlCommand(idString, dbConnection);
                SqlDataReader softwareReportRecord = newID.ExecuteReader();
                softwareReportRecord.Read();
                string reportID = Convert.ToString(softwareReportRecord["reportID"]);
                softwareReportRecord.Close();

                string editRecord = "UPDATE softwareLog SET "
            + "typeOS='" + typeOS + "', "
            + "reportDate='" + reportDate + "', "
            + "hardware='" + hardware + "' "
            + "occurrence='" + occurrence + "' "
            + "shortDescription='" + shortDescription + "' "
            + "longDescription='" + longDescription + "' "
            + "actionsTaken='" + actionsTaken + "' "
            + "WHERE reportID=" + reportID + ";";



                    SqlCommand sqlCommand = new SqlCommand(editRecord, dbConnection);
                    sqlCommand.ExecuteNonQuery();
                }


                dbConnection.Close();
            }
        }
    }
}




finally
                {
                    string addRecord = "INSERT INTO softwareLog VALUES('"
                        + typeOS + "', '"
                        + reportDate + "', '"
                        + hardware + "', '"
                        + occurrence + "', '"
                        + shortDescription + "', '"
                        + longDescription + "', '"
                        + actionsTaken + "')";

                    SqlCommand sqlCommand = new SqlCommand(addRecord, dbConnection);
                    sqlCommand.ExecuteNonQuery();
                }
                string idString = "SELECT IDENT_CURRENT('softwareLog') AS reportID";
                SqlCommand newID = new SqlCommand(idString, dbConnection);
                SqlDataReader softwareReportRecord = newID.ExecuteReader();
                softwareReportRecord.Read();
                string reportID = Convert.ToString(softwareReportRecord["reportID"]);
                softwareReportRecord.Close();
                regMessage.Text += "<p>Sorry for your inconvience. We will be working on your problem ASAP.  For reference your ID is  </p>" + reportID;

                dbConnection.Close();
4

4 回答 4

2

您在更新中缺少太多“,”。 编辑 您在字符串中有单引号。您还需要转义这些引号:

string editRecord = "UPDATE softwareLog SET "
    + "typeOS='" + typeOS.Replace("'", "''") + "', "
    + "reportDate='" + reportDate + "', "
    + "hardware='" + hardware.Replace("'", "''") + "',"
    + "occurrence='" + occurrence.Replace("'", "''") + "',"
    + "shortDescription='" + shortDescription.Replace("'", "''") + "',"
    + "longDescription='" + longDescription + "',"
    + "actionsTaken='" + actionsTaken.Replace("'", "''") + "'"
    + "WHERE reportID= " + reportID ;

在插入中,您不需要报告 ID 的报价:

string addRecord = "INSERT INTO softwareLog VALUES('"
    + typeOS.Replace("'", "''") + "', '"
    + reportDate + "', '"
    + hardware.Replace("'", "''") + "', '"
    + occurrence.Replace("'", "''") + "', '"
    + shortDescription.Replace("'", "''") + "', '"
    + longDescription.Replace("'", "''") + "', '"
    + actionsTaken.Replace("'", "''") + "')";
于 2013-10-12T03:52:45.940 回答
0

传递给查询的数据很可能会提前终止字符串。由于许多原因(包括这个原因,还有 SQL 注入),您应该使用参数而不是串联。

于 2013-10-12T03:52:09.487 回答
0

像这样试试

 string editRecord = "UPDATE softwareLog SET "
          + "typeOS='" + typeOS + "', "
          + "reportDate='" + reportDate + "', "
          + "hardware='" + hardware + "',"
          + "occurrence='" + occurrence + "',"
          + "shortDescription='" + shortDescription + "',"
          + "longDescription='" + longDescription + "',"
          + "actionsTaken='" + actionsTaken + "'"
          + "WHERE reportID=" + reportID + "";

您能否也添加您的插入语句。

备注:此类操作最好使用参数化SqlCommand 或Store Procedure。

如果您向任何字段提供带有 ' 的值,那么它将不起作用。还要检查您为 ReportId 提供的值。

于 2013-10-12T03:58:39.060 回答
0

在此示例中,您应该使用参数作为其他人提到的防止 SQL 注入的预防措施。

但是对于其他字符串,我建议您查看 string.Format() 而不是连接所有内容。将使该字符串更易于阅读。

于 2013-10-12T13:53:32.340 回答