asp.net中的SQL错误

Question

如果你请帮助我,我在sql代码asp.net C#中遇到问题.

我的错误是:

System.Data.SqlClient.SqlException未被用户代码
Message =在')'附近的语法错误处理.

我的查询代码如下:

string query = @"insert into ReviewPaper(Overall_Rating,Paper_ID,Conference_Role_ID,Deitails) 
                             values(" + 0 + "," + ListBox4.SelectedValue +"," + ListBox1.SelectedValue + "," + null + ")";

Answer 1

你不能这样插入null.使用参数化查询.

string query = "insert into ReviewPaper(Overall_Rating,Paper_ID,Conference_Role_ID,Deitails)
                values (@overall_rating,@paper_id,@conference_role_id,@details)";

cmd=new SqlCommand(query,cn);
cmd.Parameters.AddWithValue("@overall_rating",0);
cmd.Parameters.AddWithVaule("@paper_id",ListBox2.SelectedValue);
cmd.Parameters.AddWithValue("@conference_role_id",Listbox1.SelectedValue);
cmd.Parameters.AddWithValue("@details",DBNull.Value);

Answer 2

是的,正如其他人已经说过的那样,你不能像你这样做那样使用null,但是存在比这更严重的问题:

1. 您的sql语句容易受到SQL注入攻击,因为您没有参数化查询

2. 如果您没有在列中插入值,只需不列出该列!这将有效:

   string query = @"insert into ReviewPaper(Overall_Rating,Paper_ID,Conference_Role_ID) values(" + 0 + "," + ListBox4.SelectedValue +"," + ListBox1.SelectedValue +")";