ASP.NET未将命令发送到SQL Server

Question

I have been assigned to create a website for a club at my school at kmhsmc.somee.com . I choose ASP for the language and I am having an issue with a sql function. If you go to the website above and click on join current liveclub session and fill in a bunch of junk in the textboxes at the top and hit join, it throws a SQL exception. here is the code:

    UName = TextBox1.Text;
    CompN = TextBox2.Text;
    TMin = TextBox3.Text;
    Name = TextBox4.Text;
    TextBox1.Visible = false;
    TextBox2.Visible = false;
    TextBox3.Visible = false;
    TextBox4.Visible = false;
    string sql = "INSERT INTO table_name values (" + Name + "," + UName + "," + CompN +     "," + TMin + "," + "NA" + "," + 0 + ")";
    conn.Open();
    try
    {
        SqlCommand cmd = new SqlCommand(sql, conn);
        cmd.ExecuteNonQuery();
    }
    catch
    {
        Response.Write("<script>alert('SQL error: try again later')</script>");
    }
    finally
    {
        conn.Close();
    }

And for anyone who asks, I am 110% sure it is not the connection string because it works just fine on the calender page of the site.

Here is some other relevant information about this project:

• I am doing it in C# and HTML ONLY (CSS and other designing things will be done by someone else later)
• The server uses SQL server 2012

Answer 1

Problem : you are not enclosing the String types VARCHAR,NVARCHAR columns inside single quotes .
Solution : you need to enclose the String types inside single quotes .

Try This:

sqlCmd.CommandText = "INSERT INTO tablename(name) VALUES('yourname');

Suggestion : You should use Parameterised queries to avoid SQL injection attacks .

Complete Code: using parameterised sql queries

string sql = "INSERT INTO table_name values (@Name,@UName,@CompN,@TMin,@value1,@value2)";
conn.Open();
try
{
    SqlCommand cmd = new SqlCommand(sql, conn);
    cmd.Parameters.AddWithValue("@Name",Name);  
    cmd.Parameters.AddWithValue("@UName",UName);
    cmd.Parameters.AddWithValue("@CompN",CompN);
    cmd.Parameters.AddWithValue("@TMin",TMin);
    cmd.Parameters.AddWithValue("@value1","NA");
    cmd.Parameters.AddWithValue("@value2",0);
    cmd.ExecuteNonQuery();
}

Answer 2

your sql string is wrong.

UName = TextBox1.Text;
CompN = TextBox2.Text;
TMin = TextBox3.Text;
Name = TextBox4.Text;
TextBox1.Visible = false;
TextBox2.Visible = false;
TextBox3.Visible = false;
TextBox4.Visible = false;
string sql = "INSERT INTO table_name values ('" + Name + "','" + UName + "','" + CompN + "','" + TMin + "','NA', 0 )";
conn.Open();
try
{
    SqlCommand cmd = new SqlCommand(sql, conn);
    cmd.ExecuteNonQuery();
}
catch
{
    Response.Write( "<script>alert( 'SQL error: try again later' )</script>" );
}
finally
{
    conn.Close();
}