{"'C'附近的语法不正确."} .....错误调试

Question

SqlConnection conn = new SqlConnection("Server=ILLUMINATI;" + 
    "Database=DB;Integrated Security= true");
SqlCommand comm = new SqlCommand(
    "Insert into FileUpload ('FilePath','TypeId','UploadedBy','UploadedDate') 
    values (" + savePath + "," + typeid + "," + NAME + "," + DateTime.Now+ ")", conn);

conn.Open();
comm.ExecuteNonQuery();
conn.Close();

它给出了一个错误说:

{"'C'附近的语法不正确."}

请有人告诉我错误.

Answer 1

您必须''在值字符串周围放置单 引号,而不是在列名称周围

试试这个

SqlCommand comm = new SqlCommand(
    "Insert into FileUpload (FilePath,TypeId,UploadedBy,UploadedDate) 
    values ('" + savePath + "','" + typeid + "','" + NAME + "',"

假设typeID是字符串,如果不是,不要放在''它周围

Answer 2

它给出错误的原因是Haris说 - 你把单引号放在错误的地方.

但是,通过将引号放在不同的位置来"修复"这将是一个非常糟糕的主意.相反,您应该使用参数化查询:

SqlCommand comm = new SqlCommand
    ("Insert into FileUpload (FilePath, TypeId, UploadedBy, UploadedDate)" +
     " values (@savePath, @typeid, @name, @now)", conn);
comm.Parameters.AddWithValue("@savePath", savePath);
comm.Parameters.AddWithValue("@typeid", typeid);
comm.Parameters.AddWithValue("@name", NAME);
comm.Parameters.AddWithValue("@now", DateTime.Now);

通过将数据表示为数据而不是作为"代码"(SQL)的一部分,您可以避免担心转换(例如日期格式)并避免SQL注入攻击.

有关SqlCommand.Parameters更多详细信息,请参阅文档(或搜索"参数化查询").