将查询插入Access C＃

Question

I'm working with Access Data Base, I have a Users Table.

I have an Insert query :

DataBase.Execute("Insert into Users(UserID,FirstName,SecondName,UserName,Password,Permission) Values(" +
    obj.PersonID +
    ",'" + obj.FirstName +
    "','" + obj.LastName +
    "','" + username +
    "','" + psw +
    "'," + permission + ")");

I checked all the parameters' values that they are the same with the table's ones... but it says there is a syntax error in my INSERT query.

Answer 1

Parameters, parameters, parameters. First benefit for your code, you forget about single quotes. Second, you avoid the dreaded SQL injection vulnerability. Third, your code will be much easier to read. Consider this:

string insertQuery = "INSERT INTO table (field1, field2, field3) VALUES (@par1, @par2, @par3)";
Database.Execute(insertQuery, var1, var2, var3);

where var1 , var2 and var3 are the variables containing the values you need to insert.

There's a simpler (but worse, because it's still vulnerable to SQL injection) solution, that will make your code much more readable than the example you've posted: string.format. Instead of this:

DataBase.Execute("Insert into Users(UserID,FirstName,SecondName,UserName,Password,Permission) Values(" +
obj.PersonID +
",'" + obj.FirstName +
"','" + obj.LastName +
"','" + username +
"','" + psw +
"'," + permission + ")");

you could do something like this, much clearer and much more difficult to forgot some simple quotes:

string query = string.Format("Insert into Users (UserID,FirstName,SecondName,UserName,Password,Permission) Values({0}, '{1}', '{2}', '{3}', '{4}', {5})", obj.PersonID, obj.FirstName, obj.LastName, username, psw, permission);
Database.Execute(query);

Consider this as a brief example of the usage of parameters for insertion: http://msdn.microsoft.com/en-us/library/webmatrix.data.database.execute(v=vs.111).aspx