INSERT INTO中出现SYNTAX ERROR错误 [英] getting error SYNTAX ERROR in INSERT INTO

问题描述

if (DBT.returnOneValue(getID).ToString().CompareTo("") != 0)
 {

     PatientID = (Convert.ToInt32(DBT.returnOneValue(getID)) + 1).ToString();
 }
 else
 {
     PatientID = "1";
 }

 string insertQryPatient = "Insert into patient_Details(P_Id,P_name,P_Password,P_Age,P_Address,P_City,P_State,P_Country,P_Pincode,P_Phno) values (" + PatientID + ",'" + name + "','" + pwd + "'," + Age + ",'" + address + "','" + city + "','" + state + "','" + country + "','" + pin + "','" + phone + "')";

// string insertQriTreat = "Insert into Treatment_Details(Treat_Med_No,Treat_DOT,Treat_Issue_Date,Treat_Qty,Treat_Due_Date,Treat_P_ID) values ('" + MedNo + "',#" + DOT + "#,#" + IssueDateMed + "#," + MedQty + ",#" + dueDate + "#," + PatientID + ")";

 DBT.exeQuery(insertQryPatient);
//DBT.exeQuery(insertQriTreat);

 foreach (DataGridViewRow drvMedicine in gvMedicineParticulars.Rows)
 {
     MedNo = drvMedicine.Cells[0].Value.ToString();
     MedPacket = drvMedicine.Cells[1].Value.ToString();

     string insertQriTreat = "Insert into Treatment_Details(Treat_Med_No,Treat_DOT,Treat_Issue_Date,Treat_Qty,Treat_Due_Date,Treat_P_ID,Treat_P_Pkg) values ('" + MedNo + "',#" + DOT + "#,#" + IssueDateMed + "#," + MedQty + ",#" + dueDate + "#," + PatientID + "," + MedPacket + ")";

     DBT.exeQuery(insertQriTreat);
 }

推荐答案

哦亲爱的......：感叹：



不要连接字符串以构建SQL命令。它让您对意外或故意的SQL注入攻击持开放态度，这可能会破坏您的整个数据库。请改用参数化查询。

保护数据库的机会很多，使代码更具可读性，并且更易于维护，这也可以解决您的问题。

Oh dear... :sigh:

Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
The chances are that as well as protecting your DB, making your code more readable, and making it easier to maintain, that will cure your problem as well.

这篇关于INSERT INTO中出现SYNTAX ERROR错误的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！