如何解决字符串后的未闭合引号 [英] How to solve Unclosed quotation mark after the character string

问题描述

先生，

我在下面的代码中备份sql数据库时收到此错误

'D：'附近的语法错误错误字符后面的未闭合的引号字符串



代码： -

Sir,
I am getting this error while taking backup of sql database in below code that
Incorrect syntax error near 'D:' Unclosed quotation mark after the character string "

Code:-

Sub blank()
        Dim cmd As System.Data.SqlClient.SqlCommand
        Dim dr As System.Data.SqlClient.SqlDataReader
        Dim cn As System.Data.SqlClient.SqlConnection
        Dim bkp_path As String
        Try
            cn = New System.Data.SqlClient.SqlConnection(DBset())
            cn.Open()
            cmd = New System.Data.SqlClient.SqlCommand("Select [BackupPath] from Owner", cn)
            dr = cmd.ExecuteReader
            While dr.Read
                bkp_path = dr(0)
            End While
        Catch ex As Exception
        End Try
        dr.Close()
        cn.Close()
        Try
            Dim t As String
            Dim d As String
            Dim m As String
            Dim y As String
            t = Date.Now.Minute.ToString + Date.Now.Hour.ToString
            d = Date.Now.Day.ToString
            m = Date.Now.Month.ToString
            y = Date.Now.Year.ToString
            Dim uniqueid As String
            uniqueid = t & d & m & y
            If cmbserver.Text = "" Or cmbdatabase.Text = "" Then
                MsgBox("Server & Database Name Should Not Blank")
                Exit Sub
            Else
                Timer1.Enabled = True
                ProgressBar1.Visible = True
                cmd = New SqlCommand("backup database " & cmbdatabase.Text.Trim & " to disk=" & bkp_path & "" & cmbdatabase.Text.Trim & "_" & uniqueid & ".bak'", con)
                con.Open()
                cmd.ExecuteNonQuery()
                con.Close()
            End If
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
End Sub

请帮我解决这个问题。

Please help me how to solve this.

推荐答案

谷歌的Sql注入攻击，找出为什么使用字符串连接构建SQL语句是如此糟糕。



下一步，谷歌为vb.net Sql参数化查询找出如何缓解SQL注入攻击问题并解决您在鳕鱼中遇到的问题e。

Google for "Sql Injection Attack" to find out why building a SQL statement using string concatenation is so bad.

Next, Google for "vb.net Sql parameterized queries" to find out how to mitigate the SQL Injection Attack problem AND fix the problem you're having in your code.

忘记未闭合的引号，如果你以准确的方式重新编写代码，你将很容易解决这个问题。



你的方法从一开始就是错误的。通过串联从UI获取的字符串组成的查询。不仅重复的字符串连接是低效的（因为字符串是不可变的;我是否必须解释为什么它会使重复连接变坏？），但是有更重要的问题：它打开了通向良好的大门已知的漏洞称为 SQL注入。



这是它的工作原理： http://xkcd.com/327 。



你明白了吗？从控件中获取的字符串可以是任何东西，包括......一段SQL代码。



怎么办？只需阅读有关此问题和主要补救措施：参数化语句： http://en.wikipedia.org/ wiki / SQL_injection 。



使用ADO.NET，使用：http://msdn.microsoft.com/en-us/library/ff648339.aspx 。



请参阅我过去的答案有更多细节：

在com.ExecuteNonQuery中更新EROR（ ）; ，

嗨名字没有显示在名称中？。

-SA

Forget unclosed quotation mark, you will easily fix this problem if you re-write your code in accurate way.

Your approach is wrong from the very beginning. The query composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327.

Are you getting the idea? The string taken from a control can be anything, including… a fragment of SQL code.

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection.

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx.

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();,
hi name is not displaying in name?.

—SA

这篇关于如何解决字符串后的未闭合引号的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！