复制到数据库时c#程序中的错误

Question

namespace DB1
{
    public partial class Form1 : Form
    {
        private void button1_Click(object sender, EventArgs e)
        {
            String query="INSERT INTO  Student 
            VALUES("+textBox1.Text+"','"+textBox2.Text+"','"+textBox3.Text+"',
            '"+textBox4.Text+")";

            OleDbConnection conn = new 
            OleDbConnection("Provider=Microsoft.ACE.OLEDB.12.0;
            Data Source=C:\\Database11.accdb");
            OleDbCommand cmd = new OleDbCommand(query,conn);
            conn.Open();
            cmd.ExecuteNonQuery();
            MessageBox.Show("data stored succesfully");
            conn.Close();
            textBox1.Text = (Convert.ToInt32(textBox1.Text) + 1).ToString();
            textBox2.Text = (Convert.ToInt32(textBox2.Text) + 1).ToString();
            textBox3.Text = (Convert.ToInt32(textBox3.Text) + 1).ToString();
            textBox4.Text = (Convert.ToInt32(textBox4.Text) + 1).ToString();
            textBox1.Focus();

        }
        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            autonum();
        }

        private void autonum()
        {
            string query;

            query = "Select max(Stdno) from student";
            OleDbConnection conn = new      
            OleDbConnection("Provider=Micrsoft.ACE.OLEDB.12.0;
            Data Source=datasource");
            OleDbCommand cmd = new OleDbCommand(query,conn);
            conn.Open();
            try
            {
             OleDbDataReader dr =cmd.ExecuteReader();
                if(dr.Read())
                {
                    textBox1.Text = (Convert.ToInt32(dr[0])+1).ToString();
                }
                else
                {
                    textBox1.Text="1001";
                }

                dr.Close();
            }
        catch(Exception ex)
            {
                MessageBox.Show(ex.Message);
               textBox1.Text = "1001";
            }
            conn.Close();
        }
    }
}

错误是:

oledb异常未处理查询表达式'2','wse','22','assd'中的语法错误(缺少运算符).

Answer 1

不要使用字符串标注来构建查询.使用参数代替:

string query = "INSERT INTO Student VALUES (@P1, @P2, @P3, @P4)";
// ...
cmd.Parameters.Add(new OleDbParameter("@P1", textBox1.Text));
cmd.Parameters.Add(new OleDbParameter("@P2", textBox2.Text));
cmd.Parameters.Add(new OleDbParameter("@P3", textBox3.Text));
cmd.Parameters.Add(new OleDbParameter("@P4", textBox4.Text));

我还建议:

• 显式列出insert语句中的列.
• 为文本框使用描述性名称.