Question

我正试图通过使用SqlConnection的参数化质,防止不得不在我所描述的变数中逃脱热带。希望得到任何帮助。

UPDATED:这是现行法典......

  Populate Connection Object
 Dim oCnn As New SqlConnection(strConnection)

  Define our sql query
 Dim sSQL As String = "INSERT INTO [" & foreignTable & "] (data_text) VALUES (@data_text) ; "

  Populate Command Object
  Dim oCmd As New SqlCommand(sSQL, oCnn)

   Add up the parameter, associated it with its value

   oCmd.Parameters.AddWithValue("@data_text", data_text)

   Opening Connection for our DB operation  
  oCnn.Open()

  Try
      Dim results As Integer = oCmd.ExecuteScalar
  Catch ex As Exception
      LabelImport.Text &= "<font color=red>ROOT Import ERROR: " & ex.ToString & ", From Database: " & dbName & ", Text String: " & data_text & "</font><br />"
      Throw
  End Try

  oCnn.Close()
  oCmd.Parameters.Clear()

感谢任何帮助。

Answer 1

Yeah说,这是不正确的。

它希望:

Dim sSQL As String = "INSERT INTO [" & foreignTable & "] (data_text) VALUES (@data_text);"

参数:

oCmd.Parameters.AddWithValue("@data_text", data_text)

Note: I don t "think" you can pass the table name as a parameter. You would have to have the table name in the string. See Parametise table name in .Net/SQL?

此外,修改如下:

Dim results As Integer = oCmd.ExecuteScalar

to

Dim results as Integer = oCmd.ExecuteNonQuery()

Answer 2

You can use table name only when creating query (I mean concatenating it from parts: "INSERT INTO " + foreignTable + " (data_text) VALUES..., AFAIK), not as query parameter. Check SqlParameterCollection.AddWithValue on MSDN for more information about SqlCommand parameters, there is very good example as well.

 Populate Connection Object 
Dim oCnn As New SqlConnection(strConnection) 

 Define our sql query 
Dim sSQL As String = "INSERT INTO " & foreignTable & " (data_text) VALUES (@data_text);" 

 Populate Command Object 
Dim oCmd As New SqlCommand(sSQL, oCnn) 

 Add up the parameter, associated it with its value 
oCmd.Parameters.AddWithValue("@data_text", data_text) 

 Opening Connection for our DB operation   
oCnn.Open()

<><>Edit>:

改为&,因为C#作为“母语”。

友情链接