如何更正update语句中的语法错误。在cmd.ExecuteNonQuery [英] How do I correct syntax error in update statement. At cmd.ExecuteNonQuery

问题描述

Private Sub Button6_Click（ByVal sender As System.Object，ByVal e As System.EventArgs）处理Button6.Click

connect.ConnectionString =Provider = Microsoft.jet.OLEDB.4.0;数据源= | datadirectory | /Lecture1.mdb

connect.Open（）

Dim cmd作为OleDb.OleDbCommand =新OleDb.OleDbCommand（Select * FROM StudentInfo，connect ）

sql =update Lecture1 set age ='&TextBox5.Text&'，Gender ='&TextBox4.Text&'，Scourse ='&TextBox3.Text&' ，Sname ='&TextBox2.Text&'，其中Srec ='&TextBox1.Text&'

cmd =新OleDb.OleDbCommand（sql，connect）

cmd.ExecuteNonQuery（）

connect.Close（）

MsgBox（更新）

解决方案

< blockquote>你永远不想写这样的代码，因为你的数据库可能被sql注入损坏和/或劫持。



相反请使用代码类似于：

 sql =   UPDATE Lecture1 SET age = @age，Gender = @Gender ... 
 cmd.Parameters.AddWithValue（  @ age，TextBox5.Text）; 
 cmd.Parameters.AddWithValue（  @ Gender，TextBox4.Text）; 
 ... 

另外，不要保留默认的控件ID。将所有文本框命名为TextBoxx会使调试变得更加困难。为他们提供有意义的ID非常快速和容易：txtAge，txtGender。你以后会感谢自己。

Private Sub Button6_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button6.Click
connect.ConnectionString = "Provider=Microsoft.jet.OLEDB.4.0; data source = |datadirectory|/Lecture1.mdb"
connect.Open()
Dim cmd As OleDb.OleDbCommand = New OleDb.OleDbCommand("Select * FROM StudentInfo", connect)
sql = "update Lecture1 set age = ' " & TextBox5.Text & " ' , Gender=' " & TextBox4.Text & " ' , Scourse ='" & TextBox3.Text & "', Sname ='" & TextBox2.Text & "' , where Srec='" & TextBox1.Text & " ' "
cmd = New OleDb.OleDbCommand(sql, connect)
cmd.ExecuteNonQuery()
connect.Close()
MsgBox("Updated")

解决方案

You never want to write code like this because your database can be damaged and/or hijacked by sql injection.

Instead please use code similar to:

sql = "UPDATE Lecture1 SET age = @age, Gender = @Gender..."
cmd.Parameters.AddWithValue("@age", TextBox5.Text);
cmd.Parameters.AddWithValue("@Gender", TextBox4.Text);
...

Also, do not leave the default control ids. Having all your textboxes named TextBoxx makes debugging much harder. It's very quick and easy to give them meaningful IDs: txtAge, txtGender. You'll thank yourself later on.

这篇关于如何更正update语句中的语法错误。在cmd.ExecuteNonQuery的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！