C#SQL语句不起作用

Question

当我执行命令将数据表的值插入SQL Server数据库时,我收到一个错误.

','附近的语法不正确.

我的代码:

for (int i = 1; i < dt.Rows.Count; i++) // i = 1 instead of 0 because of the header row
{
    wipSql = "INSERT INTO tblWIP ([FSR Number], [Customer Name], REGN_NM, SUBREGN_NM, [EMP/SUPPLIER Name], [INVTY DATE], " +
             "[COST CATEGORY], [PL&M AMOUNT], [LABOR AMOUNT], [T&L PERDIEM], [MEMO COST], [EDI SEQ#], [INVOICE NUMBER], [Grand Total], Age, Business) " + 
             "VALUES ('"
                      + dt.Rows[i]["FSR Number"].ToString().Trim() + "', '"
                      + dt.Rows[i]["Customer Name"].ToString().Trim() + "', '"
                      + dt.Rows[i]["REGN_NM"].ToString().Trim() + "', '"
                      + dt.Rows[i]["SUBREGN_NM"].ToString().Trim() + "', '"
                      + dt.Rows[i]["EMP/SUPPlier Name"].ToString().Trim() + "', '"
                      + dt.Rows[i]["INVTY DATE"].ToString().Trim() + "', '"
                      + dt.Rows[i]["COST CATEGORY"].ToString().Trim() + "', "
                      + dt.Rows[i]["PL&M AMOUNT"].ToString().Trim() + ", "
                      + dt.Rows[i]["LABOR AMOUNT"].ToString().Trim() + ", "
                      + dt.Rows[i]["T&L PERDIEM"].ToString().Trim() + ", "
                      + dt.Rows[i]["MEMO COST"].ToString().Trim() + ", '"
                      + dt.Rows[i]["EDI SEQ#"].ToString().Trim() + "', '"
                      + dt.Rows[i]["INVOICE NUMBER"].ToString().Trim() + "', "
                      + dt.Rows[i]["Grand Total"].ToString().Trim() + ", "
                      + dt.Rows[i]["Age"].ToString().Trim() + ", '"
                      + dt.Rows[i]["Business"].ToString().Trim() + "')";

    SqlCommand cmdWIP = new SqlCommand(wipSql, localConnection);
    cmdWIP.ExecuteNonQuery();
}

Answer 1

开始使用查询参数,这样的问题将被避免,您将受到保护,不受sql注入.也开始使用@这个让你可以在多行上写字符串.

wipSql = @"INSERT INTO 
            tblWIP ([FSR Number], [Customer Name], REGN_NM, SUBREGN_NM, [EMP/SUPPLIER Name], [INVTY DATE], [COST CATEGORY], [PL&M AMOUNT], [LABOR AMOUNT], [T&L PERDIEM], [MEMO COST], [EDI SEQ#], [INVOICE NUMBER], [Grand Total], Age, Business) 
           VALUES
               (@Number, @Name, @Regn_NM, .... and so on )";

//after that here
SqlCommand cmdWIP = new SqlCommand(wipSql, localConnection);
cmdWIP.Parameters.AddWithValue(@Number, dt.Rows[i]["FSR Number"].ToString().Trim());
cmdWIP.Parameters.AddWithValue(@Name, dt.Rows[i]["Customer Name"].ToString().Trim());
cmdWIP.Parameters.AddWithValue(@Regn_NM, dt.Rows[i]["REGN_NM"].ToString().Trim());
//and so on for other parameters