列名sql错误无效

Question

我试图将数据输入我的数据库,但它给我以下错误:

列名无效

这是我的代码

string connectionString = "Persist Security Info=False;User ID=sa;Password=123;Initial Catalog=AddressBook;Server=Bilal-PC";

using (SqlConnection connection = new SqlConnection(connectionString))
{
  SqlCommand cmd = new SqlCommand();

  cmd.CommandText = "INSERT INTO Data (Name,PhoneNo,Address) VALUES (" + txtName.Text + "," + txtPhone.Text + "," + txtAddress.Text + ");";
  cmd.CommandType = CommandType.Text;
  cmd.Connection = connection;

  connection.Open();
  cmd.ExecuteNonQuery();
}

Answer 1

您可能需要围绕这些字符串字段的引号,但是,您应该使用参数化查询!

cmd.CommandText = "INSERT INTO Data ([Name],PhoneNo,Address) VALUES (@name, @phone, @address)";
cmd.CommandType = CommandType.Text;
cmd.Parameters.AddWithValue("@name", txtName.Text);
cmd.Parameters.AddWithValue("@phone", txtPhone.Text);
cmd.Parameters.AddWithValue("@address", txtAddress.Text);
cmd.Connection = connection;

顺便提一下,您的原始查询可能已经像这样修复(请注意单引号):

"VALUES ('" + txtName.Text + "','" + txtPhone.Text + "','" + txtAddress.Text + "');";

但是这会使它容易受到SQL注入攻击,因为用户可以输入

'; drop table users; -- 

进入你的一个文本框.或者更糟糕的是,可怜的Daniel O'Reilly每次都会打破你的疑问.

Answer 2

始终尝试使用参数化的SQL查询以防止恶意发生,因此您可以重新排列代码,如下所示:

另外,还要确保你的表有列名匹配Name,PhoneNo,Address.

using (SqlConnection connection = new SqlConnection(connectionString))
{
    SqlCommand cmd = new SqlCommand("INSERT INTO Data (Name, PhoneNo, Address) VALUES (@Name, @PhoneNo, @Address)");
    cmd.CommandType = CommandType.Text;
    cmd.Connection = connection;
    cmd.Parameters.AddWithValue("@Name", txtName.Text);
    cmd.Parameters.AddWithValue("@PhoneNo", txtPhone.Text);
    cmd.Parameters.AddWithValue("@Address", txtAddress.Text);
    connection.Open();
    cmd.ExecuteNonQuery();
}

Answer 3

改变这一行:

cmd.CommandText = "INSERT INTO Data (Name,PhoneNo,Address) VALUES (" + txtName.Text + "," + txtPhone.Text + "," + txtAddress.Text + ");";

对此:

cmd.CommandText = "INSERT INTO Data (Name,PhoneNo,Address) VALUES ('" + txtName.Text + "','" + txtPhone.Text + "','" + txtAddress.Text + "');";

您的insert命令需要文本,并且您需要在实际值之间使用单引号('),以便SQL可以将其理解为文本.

编辑:对于那些对这个答案不满意的人,我想指出这个代码在SQL注入方面存在问题.当我回答这个问题时,我只考虑了一个问题,即他的代码中缺少单引号,我指出了如何修复它.亚当已经发布了一个更好的答案(我投了赞成票),在那里他解释了注射问题,并展示了一种预防方法.现在放松,快乐的家伙.

Answer 4

你的问题是你的字符串是不加引号的.这意味着它们被数据库引擎解释为列名.

您需要创建参数才能将值传递给查询.

 cmd.CommandText = "INSERT INTO Data (Name, PhoneNo, Address) VALUES (@Name, @PhoneNo, @Address);";
 cmd.Parameters.AddWithValue("@Name", txtName.Text);
 cmd.Parameters.AddWithValue("@PhoneNo", txtPhone.Text);
 cmd.Parameters.AddWithValue("@Address", txtAddress.Text);