将日期插入SQL

Question

我正在尝试在SQL表中插入日期,但是当程序运行时它会出现以下错误.

从字符串转换日期和/或时间时转换失败.

string dateReleased = DateReleasedDate.Value.ToString("YYYY-MM-DD");

string myQuery = "INSERT INTO GameTbl (gameName, genreID, players, online, dateReleased, dateAdded, developerID, publisherID, consoleID) VALUES('" 
                + GameNameTxt.Text + "', '" + GenreCombo.SelectedValue + "', '" + PlayersNUD.Value + "', '" + OnlineCombo.SelectedText + "', '"
                + dateReleased  + "', 'GETDATE()', '" + DeveloperCombo.SelectedValue + "', '" 
                + PublisherCombo.SelectedValue + "','" + ConsoleCombo.SelectedValue + "')";

Answer 1

请使用参数化查询.当我看到用于构造SQL查询的字符串连接时,我的眼睛受到了伤害:

using (var conn = new SqlConnection("SOME CONNECTION STRING"))
using (var cmd = new SqlCommand(conn))
{
    conn.Open();
    cmd.CommandText = "INSERT INTO GameTbl (gameName, genreID, players, online, dateReleased, developerID, publisherID, consoleID) VALUES (@gameName, @genreID, @players, @online, @dateReleased, @developerID, @publisherID, @consoleID)";
    cmd.Parameters.AddWithValue("@gameName", GameNameTxt.Text);
    cmd.Parameters.AddWithValue("@genreID", GenreCombo.SelectedValue);
    cmd.Parameters.AddWithValue("@players", PlayersNUD.Value);
    cmd.Parameters.AddWithValue("@online", OnlineCombo.SelectedText);
    cmd.Parameters.AddWithValue("@dateReleased", DateReleasedDate.Value);
    cmd.Parameters.AddWithValue("@developerID", DeveloperCombo.SelectedValue);
    cmd.Parameters.AddWithValue("@publisherID", PublisherCombo.SelectedValue);
    cmd.Parameters.AddWithValue("@consoleID", ConsoleCombo.SelectedValue);
    var result = cmd.ExecuteNonQuery();
    ...
}

就dateAdded列而言,我只是将其从INSERT中删除,并直接在SQL数据库中添加一个默认值.

请注意您是如何直接传递DateTime实例并让ADO.NET处理格式的.作为奖励,您的代码可以安全地防止SQL注入.