C#中的SQL更新语句

Question

我有桌子 "学生"

   P_ID   LastName  FirstName  Address  City

   1        Hansen    Ola                
   2        Svendson   Tove
   3        Petterson   Kari
   4        Nilsen       Johan
...and so on 

如何在C#中更改编辑代码

 string firstName = "Ola";
 string  lastName ="Hansen";
 string  address = "ABC";
 string city = "Salzburg";

 string connectionString = System.Configuration.ConfigurationManager
                          .ConnectionStrings["LocalDB"].ConnectionString;

 using (SqlConnection connection = new SqlConnection(connectionString))
     using (SqlCommand command = connection.CreateCommand())
 { 
   command.CommandText = "INSERT INTO Student (LastName, FirstName, Address, City) 
                          VALUES (@ln, @fn, @add, @cit)";

   command.Parameters.AddWithValue("@ln", lastName);
   command.Parameters.AddWithValue("@fn", firstName);
   command.Parameters.AddWithValue("@add", address);
   command.Parameters.AddWithValue("@cit", city);

   connection.Open();

   command.ExecuteNonQuery();

   connection.Close();
 } 

编辑条目,其中姓字段姓价值和名字字段名字值.

我不想这样用

 UPDATE Persons  SET Address='Nissestien 67', City='Sandnes' 
 WHERE LastName='Tjessem'     AND FirstName='Jakob'

我把原来的陈述编辑成了

 command.CommandText = "UPDATE Student(LastName, FirstName, Address, City) 
   VALUES (@ln, @fn, @add, @cit) WHERE LastName='" + lastName + 
                           "' AND FirstName='" +  firstName+"'";

但声明没有被执行,为什么它会抛出SQL异常？有没有解决方案呢？

Answer 1

这不是更新SQL中记录的正确方法:

command.CommandText = "UPDATE Student(LastName, FirstName, Address, City) VALUES (@ln, @fn, @add, @cit) WHERE LastName='" + lastName + "' AND FirstName='" + firstName+"'";

你应该这样写:

command.CommandText = "UPDATE Student 
SET Address = @add, City = @cit Where FirstName = @fn and LastName = @add";

然后添加与为插入操作添加的参数相同的参数.

Answer 2

我不想这样用

这是UpdateSQL中语句的语法,您必须使用该语法,否则您将获得异常.

command.Text = "UPDATE Student SET Address = @add, City = @cit Where FirstName = @fn AND LastName = @ln";

然后相应地添加您的参数.

command.Parameters.AddWithValue("@ln", lastName);
command.Parameters.AddWithValue("@fn", firstName);
command.Parameters.AddWithValue("@add", address);
command.Parameters.AddWithValue("@cit", city);  

Answer 3

string constr = @"Data Source=(LocalDB)\v11.0;Initial Catalog=Bank;Integrated Security=True;Pooling=False";
SqlConnection con = new SqlConnection(constr);
DataSet ds = new DataSet();
con.Open();
SqlCommand cmd = new SqlCommand(" UPDATE Account  SET name = Aleesha, CID = 24 Where name =Areeba and CID =11 )";
cmd.ExecuteNonQuery();

Answer 4

如果您不想使用 SQL 语法（您被迫使用），那么请切换到诸如 Entity Framework 或 Linq-to-SQL 之类的框架，在这些框架中您不必自己编写 SQL 语句。

Answer 5

每种语言都有合适的语法。同样，SQL（结构化查询语言）也有特定的更新查询语法，如果我们想使用更新查询，我们必须遵循这些语法。否则它不会给出预期的结果。

Answer 6

请永远不要使用这种连接形式：

String st = "UPDATE supplier SET supplier_id = " + textBox1.Text + ", supplier_name = " + textBox2.Text
        + "WHERE supplier_id = " + textBox1.Text;

使用：

command.Parameters.AddWithValue("@attribute", value);

始终面向对象工作

编辑：这是因为当您参数化更新时，它有助于防止 SQL 注入。