Jam*_*ieB -2 c# sql-server asp.net visual-studio-2010
我在Visual Web Dev 2010 Express中使用C#创建了一个Web表单,它包含文本框/标签(基于复选框)但是当我运行代码时运行SQL命令失败.我在使用3个文本框之前已经使代码工作,但在扩展代码时似乎不起作用.
我尝试过的事情:
当谷歌搜索有人说一些关于引号是一个问题(并且错误反映了这一点),但如果我从SQL命令中删除所有引用它失败但我的想法是它总是必须'"+datahere+"'是真的吗？
我还将在错误下方引用我所有的代码,以查找有问题的Web表单.当我运行'debug'时,错误看起来像这样:
't'附近的语法不正确.字符串')'后面的未闭合引号.
描述:执行当前Web请求期间发生未处理的异常.请查看堆栈跟踪以获取有关错误及其源自代码的位置的更多信息.
异常详细信息:System.Data.SqlClient.SqlException:'t'附近的语法不正确.字符串')'后面的未闭合引号.
来源错误:
Line 40: }
Line 41: SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
Line 42: cmd.ExecuteNonQuery();
Line 43: con.Close();
Line 44: Label1.Visible = true;
源文件:C:\ Users\MYNAME\Documents\Visual Studio 2010\Projects\SicknessDBNewSite\SicknessDBNewSite\WebForm2.aspx.cs行:42
堆栈跟踪:
[SqlException (0x80131904): Incorrect syntax near 't'.
Unclosed quotation mark after the character string ')'.]
System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +1791910
System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +5347106
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +546
System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +1693
System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) +869
System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +413
System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +163
SicknessDBNewSite.WebForm2.Button1_Click(Object sender, EventArgs e) in C:\Users\MYNAME\Documents\Visual Studio 2010\Projects\SicknessDBNewSite\SicknessDBNewSite\WebForm2.aspx.cs:42
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +9653178
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +103
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +10
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +13
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +35
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1724
代码背后:webform2.aspx
<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="WebForm2.aspx.cs" Inherits="SicknessDBNewSite.WebForm2" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
<style type="text/css">
.style1
{
width: 72%;
}
.style2
{
width: 443px;
}
.style3
{
text-align: center;
text-decoration: underline;
}
.style4
{
width: 443px;
height: 65px;
}
.style5
{
height: 65px;
}
.style6
{
text-align: center;
}
</style>
</head>
<body>
<form id="form1" runat="server">
<div style="text-align: center">
<h1 class="style3">
Test Form Submission
</h1>
<table class="style1" align="center">
<tr>
<td class="style2">
Name</td>
<td>
<asp:TextBox ID="txtname" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Grade</td>
<td>
<asp:TextBox ID="txtgrade" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Depot</td>
<td>
<asp:TextBox ID="txtdepot" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Nature of Illness?</td>
<td>
<asp:TextBox ID="txtillness" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Appointment made to see doctor (Yes or No)?</td>
<td>
<asp:RadioButton ID="RadioAppointmentYes" runat="server" Text="Yes" />
<asp:RadioButton ID="RadioAppointmentNo" runat="server" Text="No" />
<asp:Label ID="LabelAppointment" runat="server" Visible="False"></asp:Label>
</td>
</tr>
<tr>
<td class="style2">
Medication Taken (Yes or No)?</td>
<td class="style6">
<asp:RadioButton ID="RadioMedicationYes" runat="server" Text="Yes" />
<asp:RadioButton ID="RadioMedicationNo" runat="server" Text="No" />
<asp:Label ID="LabelMedication" runat="server" Visible="False"></asp:Label>
</td>
</tr>
<tr>
<td class="style2">
Expected length of absence?</td>
<td>
<asp:TextBox ID="txtabsence" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
If not contacted by staff member, who contacted on their behalf?</td>
<td>
<asp:TextBox ID="txtcontactby" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Likely resumption date?</td>
<td>
<asp:TextBox ID="txtresumedate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Contact telephone number</td>
<td>
<asp:TextBox ID="txtcontactnum" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Latest update date</td>
<td>
<asp:TextBox ID="txtupdate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style4">
Details</td>
<td class="style5">
<asp:TextBox ID="txtdetails" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Resumption Date</td>
<td>
<asp:TextBox ID="txtresumeddate" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Detail</td>
<td>
<asp:TextBox ID="txtdetail" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Is the person still on medication at the time of resumption?</td>
<td>
<asp:TextBox ID="txtmedonreturn" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Controller / Planner's name</td>
<td>
<asp:TextBox ID="txtreporter" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Date of contact</td>
<td>
<asp:TextBox ID="txtdateofcontact" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
Date and time of next shift</td>
<td>
<asp:TextBox ID="txtdatetimeshift" runat="server" Width="500px"></asp:TextBox>
</td>
</tr>
<tr>
<td class="style2">
</td>
<td>
<asp:Button ID="Button1" runat="server" onclick="Button1_Click" Text="Submit" Width="100px" />
</td>
</tr>
</table>
</div>
<a href="http://INTRANET/webform1.aspx">
<asp:Label ID="Label1" runat="server" ForeColor="Green" Visible="False" /></asp:Label>
</a>
<asp:SqlDataSource ID="SqlDataSource1" runat="server"
ConnectionString="<%$ ConnectionStrings:ConnectionStringTestFormSubmission %>"
SelectCommand="SELECT * FROM [sicknesstest]"></asp:SqlDataSource>
</form>
</body>
</html>
webform2.aspx.cs
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;
namespace SicknessDBNewSite
{
public partial class WebForm2 : System.Web.UI.Page
{
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionStringTestFormSubmission"].ConnectionString);
protected void Page_Load(object sender, EventArgs e)
{
con.Open();
}
protected void Button1_Click(object sender, EventArgs e)
{
if (RadioAppointmentYes.Checked)
{
LabelAppointment.Text = "Yes";
}
else if (RadioAppointmentNo.Checked)
{
LabelAppointment.Text = "No";
}
if (RadioMedicationYes.Checked)
{
LabelAppointment.Text = "Yes";
}
else if (RadioMedicationNo.Checked)
{
LabelAppointment.Text = "No";
}
SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+LabelAppointment.Text+"','"+LabelMedication.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
cmd.ExecuteNonQuery();
con.Close();
Label1.Visible = true;
Label1.Text = "Your Data has been stored successfully! Click here to view";
txtname.Text = "";
txtgrade.Text = "";
txtdepot.Text = "";
txtillness.Text = "";
txtabsence.Text = "";
txtcontactby.Text = "";
txtupdate.Text = "";
txtdetails.Text = "";
txtresumedate.Text = "";
txtdetail.Text = "";
txtmedonreturn.Text = "";
txtreporter.Text = "";
txtdateofcontact.Text = "";
txtresumeddate.Text = "";
}
}
}
- Datesource:
WebConfig:
数据库作为"测试托架"在我的机器上本地运行,并且我可以看到工作.
<add name="ConnectionStringTestFormSubmission" connectionString="Data Source=G00069-PC\SQLEXPRESS;Initial Catalog=SicknessDatabase;Persist Security Info=True;User ID=REMOVED;Password=REMOVED"
providerName="System.Data.SqlClient" />
如果在尝试执行字符串之前输出字符串,则92.7%(a)的SQL执行问题变得明显.
你可能在输入字段的某个地方有一个流浪的引用,不一定是恶意的 - 它可能是由oh no, we won't goor code doesn't work或者之类的东西引起的contact Mr O'Rourke.
这意味着做类似的事情:
string strcmd = "insert into ...";
// Examine/output strcmd here.
SqlCommand cmd = new SqlCommand(strcmd);
cmd.ExecuteNonQuery();
然后,一旦你运行它,查找两个术语"SQL注入攻击"和"SQL预处理语句".在某些时候,你会想要开始使用后者来防止前者.
(a)图中拉出的空气,实际值可能会有所不同:-)
小智 5
我的建议是在查询中使用参数而不是连接.在sql查询中使用参数的示例如下:
IDbCommand command = conn.CreateCommand();
command.CommandText = "SELECT * FROM M_ITEM_SERIAL WHERE ITSR_PLANT_ID = @plantId";
IDbDataParameter plantIdParam = command.CreateParameter();
plantIdParam.ParameterName = "@plantId";
plantIdParam.Direction = ParameterDirection.Input;
plantIdParam.Value = plantId;
command.Parameters.Add(plantIdParam);
| 归档时间： |
|
| 查看次数： |
34738 次 |
| 最近记录： |