使用C#和asp.net将sql插入access数据库时出现语法错误
本文关键字:数据库 错误 语法 access 插入 asp net sql 使用 | 更新日期: 2023-09-27 18:00:20
我在线上得到一个错误
cmd.ExecuteNonQuery();
上面写着
INSERT INTO语句中的语法错误
我认为我的查询应该是有效的,我不理解这个问题,我已经处理了好几个小时了。它的顺序是正确的,把[]
放在Users
周围对我不起作用,非常感谢帮助。
<%@ Page Language ="C#" %>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.OleDb" %>
<script runat="server">
protected void Page_Load()
{
String username = Request.Form["username"];
String email = Request.Form["email"];
String password = Request.Form["password1"];
var age = Request.Form["age"];
String country = Request.Form["country"];
String hobbie = Request.Form["skin"];
String sql;
sql = "INSERT INTO Users(UserName, Email, Password, Age, Country, Hobbie) VALUES('" + username + "','" + email + "','" + password + "'," + age + ",'" + country + "','" + skin + "')";
String Path = Server.MapPath("App_Data/Users.accdb");
String connStr = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source="+Path;
OleDbConnection conn = new OleDbConnection(connStr);
conn.Open();
OleDbCommand cmd = new OleDbCommand(sql, conn);
cmd.ExecuteNonQuery();
conn.Close();
}
PASSWORD是MS Access的保留关键字。使用方括号中的
sql = "INSERT INTO Users(UserName, Email, [Password] ....
但是,请将该sql文本更改为使用参数化查询。此外,如果您能够使用实际值发送此命令,那么您的查询仍然存在Sql注入漏洞,并且当您的输入字符串包含单引号时,可能会出现解析问题
sql = @"INSERT INTO Users(UserName, Email, [Password], Age, Country, Hobbie)
VALUES(?,?,?,?,?,?)";
....
OleDbCommand cmd = new OleDbCommand(sql, conn);
cmd.Parameters.AddWithValue("@p1", username);
.... and so on for the other 5 parameters required by the query ....
我认为密码是一个保留字。像[密码]一样使用
试试这个
sql = "INSERT INTO Users(UserName,Email,[Password],Age,Country,Hobbie) VALUES('" + username + "','" + email + "','" + password + "'," + age + ",'" + country + "','" + skin + "')";
不建议这样做。使用参数化查询。如下所示:
sql = "INSERT INTO Users(UserName, Email, [Password], Age, Country, Hobbie)
VALUES(@UserName,@Email,@Password,@Age,@Country,@Hobbie)";
OleDbCommand cmd = new OleDbCommand(sql, conn);
cmd.Connection = conn;
cmd.CommandType = CommandType.Text;
cmd.Parameters.AddWithValue("@UserName", username);
cmd.Parameters.AddWithValue("@Email", Email);
cmd.Parameters.AddWithValue("@Password", Password);
cmd.Parameters.AddWithValue("@Age", Age);
cmd.Parameters.AddWithValue("@Country", Country);
cmd.Parameters.AddWithValue("@Hobbie", Hobbie);
使用[Password]而不是Password