C#Database Compact连接错误

Question

我使用一个简单的表单测试一些数据库压缩代码,以便将数据添加到数据库.当我单击AddBtn时,我想要的是将一些值从文本字段插入到我的数据库中,但我得到此错误"初始化字符串的格式不符合从索引0开始的规范".问题似乎在SqlCeConnection行中.

完整的代码示例:

    using System;
    using System.Collections.Generic;
    using System.ComponentModel;
    using System.Data;
    using System.Drawing;
    using System.Linq;
    using System.Text;
    using System.Threading.Tasks;
    using System.Windows.Forms;
    using System.Data.Sql;
    using System.Data.SqlClient;
    using System.Data.SqlServerCe;

    namespace WindowsFormsApplication1
    {
        public partial class Form1 : Form
        {
            public Form1()
            {
        InitializeComponent();
            }

            private void AddBtn_Click(object sender, EventArgs e)
            {
                SqlCeConnection con = new SqlCeConnection(@"C:\Users\Name\Documents\Visual Studio         2012\Projects\DataBaseTest\MyDatabase#1.sdf");
                try {
                    con.Open();

                    SqlCeCommand cmd = con.CreateCommand();

                    cmd.CommandText = "insert into test ([ID], [OrderID], [KundID]) values('"+textBox1.Text+"','"+textBox2.Text+"','"+textBox3.Text+"')";

                    try {
                        cmd.ExecuteNonQuery();
                    }
                    catch (Exception ex) {
                        MessageBox.Show(ex.Message);
                    }


                }
                catch (Exception ex) {
                    MessageBox.Show(ex.Message);
                }
            }
        }
    }

Answer 1

是的你的连接字符串是错误的.
在这里查看http://www.connectionstrings.com/sql-server-2005-ce

纠正的应该是

 string pathSDF = @"C:\Users\Name\Documents\Visual Studio 2012" + 
                   "\Projects\DataBaseTest\MyDatabase#1.sdf";
 SqlCeConnection con = new SqlCeConnection("Data Source=" + pathSDF + 
                                           ";Persist Security Info=False;");

除此之外,您的SQL命令非常危险.你永远不应该写sql命令连接直接从用户输入获取的字符串.这会导致Sql注入攻击
将您的代码更改为:(我假设您的ID字段是数字类型而不是varchars)

  cmd.CommandText = "insert into test ([ID], [OrderID], [KundID]) values " + 
                    "(@userID, @orderID, @kundID)";  

  cmd.Parameters.AddWithValue("@userID", Convert.ToInt32(textBox1.Text));
  cmd.Parameters.AddWithValue("@orderID", Convert.ToInt32(textBox2.Text));
  cmd.Parameters.AddWithValue("@kundID", Convert.ToInt32(textBox3.Text));