字符串后面的未闭合引号附近的语法不正确 [英] Incorrect syntax near unclosed quotation mark after the character string
问题描述
我正在使用c＃2010创建Windows应用程序，这里我使用数据网格视图进行计费，一旦我将值存储到数据库，然后一段时间后我检索我的第一个帐单值，我正在做一些更改并更新相同账单号码的记录，但是时间错误来了。
这是我的更新代码
使用（SqlConnection connect = new SqlConnection（db.Connectionstring（）））
{
使用（SqlCommand command = new SqlCommand（））
{
string pro = ;
int qty;
int totqty;
command.Connection = connect;
command.CommandText = update bill set staffid = staffid'和cstid =' + txtmobile.Text + '和cstname =' + txtname。文本+ '和schemes =' + txtscheme2.Text + '和counum =' + txtnum.Text + '和date =' + txtdate.Text + '和slno = slno，proname = proname，price = price，qty = qty，protax = protax，dis = dis，amt = amt where（recnum = @ recnum）;
command.Parameters.Add（ new SqlParameter（ @ staffid， SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @cstid，SqlDbType.Int））;
command.Parameters.Add（ new SqlParameter（ @cstname，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @schemes，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @counum，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @ recnum，SqlDbType.Int））;
command.Parameters.Add（ new SqlParameter（ @date，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @slno，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @proname，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @price，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @qty，SqlDbType.VarChar））;
command.Parameters.Add（ new SqlParameter（ @protax，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @dis，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @amt，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @ totamt，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @amtdis，SqlDbType.Float））;
command.Parameters.Add（ new SqlParameter（ @finamt，SqlDbType.Float））;
connect.Open（）;
foreach （DataGridViewRow row in dgvfind.Rows）
{
if （！row.IsNewRow）
{
command.Parameters [ < span class =code-string> @ staffid]。Value = txtstaff.Text;
command.Parameters [ @ cstid]。Value = txtmobile.Text;
command.Parameters [ @ cstname]。Value = txtname.Text;
command.Parameters [ @ schemes]。Value = txtscheme2.Text;
command.Parameters [ @ counum]。Value = txtnum.Text;
command.Parameters [ @ recnum]。值= lblbill。文本;
command.Parameters [ @ date]。Value = txtdate.Text;
command.Parameters [ @ slno]。Value = row.Cells [ 0 ]。值;
command.Parameters [ @ proname]。值= row.Cells [ 1 ]值。
pro = row.Cells [ 1 ]。Value.ToString（）;
command.Parameters [ @ price]。值= row.Cells [ 2 ]值。
command.Parameters [ @ qty]。值= row.Cells [ 3 ]值。
qty = Convert.ToInt32（row.Cells [ 3 ]。Value）;
command.Parameters [ @ protax]。值= row.Cells [ 4 ]值。
command.Parameters [ @ dis]。值= row.Cells [ 5 ]值。
command.Parameters [ @ amt]。值= row.Cells [ 6 ]值。
command.Parameters [ @ totamt]。Value = txt_netamount。文本;
command.Parameters [ @ amtdis]。Value = textBox3.Text;
command.Parameters [ @ finamt]。Value = textBox2.Text;
command.ExecuteNonQuery（）;
但错误来了
' 和cstid ='。
字符字符串 ' 后的未闭合引号和slno = slno，proname = proname，price = price，qty = qty，protax = protax，dis = dis，amt = amt where（recnum = @ recnum）'。
如何解决上述错误任何人给我的想法。
我尝试过：
字符串
之后的未闭合引号附近的语法不正确引号没有任何意义！
command.CommandText = update bill set staffid = staffid'和cstid ='但是，整个SQL都是错误的，即使它不是，也会非常危险。不要连接字符串以构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。改为使用参数化查询。
你甚至在那里添加了参数来添加参数，但你根本不使用它们！
尝试：
command.CommandText = 更新账单设置staffid = @ staffid，cstid = @ cstid，...
并正确提供参数：
command.Parameters.AddWithValue（ @ staffid，txtstaff.Text）;
...
但是你自己（和你的用户）一个忙：其中一些是数值，所以首先验证并将用户输入转换为适当的数值在尝试使用int.TryParse，double.TryParse等将它们传递给SQL之前。如果有问题，请将其报告给用户，而不是将错误的数据发送到数据库，并希望SQL拒绝它。
I am creating windows application using c# 2010, here i am using data grid view for billing purpose, once i am stored the values to database, and then after some time i am retrieve my first bill values and i am doing some changes and update the records for same bill number, but that time error is came.
this is for my update code
using (SqlConnection connect = new SqlConnection(db.Connectionstring()))
{
using (SqlCommand command = new SqlCommand())
{
string pro = "";
int qty;
int totqty;
command.Connection = connect;
command.CommandText = "update bill set staffid=staffid' and cstid='" + txtmobile.Text + "' and cstname='" + txtname.Text + "' and schemes='" + txtscheme2.Text + "' and counum='" + txtnum.Text + "' and date='" + txtdate.Text + "' and slno=slno, proname=proname, price=price, qty=qty, protax=protax, dis=dis, amt=amt where(recnum=@recnum)";
command.Parameters.Add(new SqlParameter("@staffid", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@cstid", SqlDbType.Int));
command.Parameters.Add(new SqlParameter("@cstname", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@schemes", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@counum", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@recnum", SqlDbType.Int));
command.Parameters.Add(new SqlParameter("@date", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@slno", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@proname", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@price", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@qty", SqlDbType.VarChar));
command.Parameters.Add(new SqlParameter("@protax", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@dis", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@amt", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@totamt", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@amtdis", SqlDbType.Float));
command.Parameters.Add(new SqlParameter("@finamt", SqlDbType.Float));
connect.Open();
foreach (DataGridViewRow row in dgvfind.Rows)
{
if (!row.IsNewRow)
{
command.Parameters["@staffid"].Value = txtstaff.Text;
command.Parameters["@cstid"].Value = txtmobile.Text;
command.Parameters["@cstname"].Value = txtname.Text;
command.Parameters["@schemes"].Value = txtscheme2.Text;
command.Parameters["@counum"].Value = txtnum.Text;
command.Parameters["@recnum"].Value = lblbill.Text;
command.Parameters["@date"].Value = txtdate.Text;
command.Parameters["@slno"].Value = row.Cells[0].Value;
command.Parameters["@proname"].Value = row.Cells[1].Value;
pro = row.Cells[1].Value.ToString();
command.Parameters["@price"].Value = row.Cells[2].Value;
command.Parameters["@qty"].Value = row.Cells[3].Value;
qty = Convert.ToInt32(row.Cells[3].Value);
command.Parameters["@protax"].Value = row.Cells[4].Value;
command.Parameters["@dis"].Value = row.Cells[5].Value;
command.Parameters["@amt"].Value = row.Cells[6].Value;
command.Parameters["@totamt"].Value = txt_netamount.Text;
command.Parameters["@amtdis"].Value = textBox3.Text;
command.Parameters["@finamt"].Value = textBox2.Text;
command.ExecuteNonQuery();
But error is came
Incorrect syntax near ' and cstid='.
Unclosed quotation mark after the character string ' and slno=slno, proname=proname, price=price, qty=qty, protax=protax, dis=dis, amt=amt where(recnum=@recnum)'.
How to solve above error any one give me ideas.
What I have tried:
Incorrect syntax near Unclosed quotation mark after the character string
Well yes - your quotation marks don't make any sense!
command.CommandText = "update bill set staffid=staffid' and cstid='"But then, the whole SQL is wrong, and even if it wasn't it would bne extremely dangerous. Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
You've even got the code in there to add the parameters, but you don't use them at all!
Try:
command.CommandText = "update bill set staffid=@staffid, cstid=@cstid, ...And provide the parameters properly:
command.Parameters.AddWithValue("@staffid", txtstaff.Text); ...
But do yourself (and your users) a favour: some of those are numeric values, so verify and convert the user inputs to the appropriate numeric value first before you try to pass them to SQL by using int.TryParse, double.TryParse, and so forth. If there is a problem, report it to the user instead of letting bad data to to the DB and hoping SQL rejects it.
这篇关于字符串后面的未闭合引号附近的语法不正确的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
