使用mysql在C＃中创建注册表单

Question

Hello so im creating a registration form in C# with MySql so it connects to the database and everything but i get this error Napaka pri registraciji Unknown column " in 'field list' the translation of Napaka pri registraciji means Error at registering i just have it in my language. I get this error when i insert data in textboxes and press Register..

the code:

private void btn_Reg_Click(object sender, EventArgs e)
    {
        MySqlConnection dataConnection = new MySqlConnection();
        dataConnection.ConnectionString = "datasource=localhost;port=3306;username=root;password=";
        dataConnection.Open();
        MySqlTransaction transakcija = dataConnection.BeginTransaction();
        MySqlCommand dataCommand = new MySqlCommand();
        dataCommand.Connection = dataConnection;
        dataCommand.Transaction = transakcija;
        try
        {
            dataCommand.CommandText = "Insert INTO lr.users (upIme,geslo) VALUES (`"+this.tB_upIme.Text+"`,`"+this.tB_geslo.Text+"`)";
            dataCommand.CommandType = CommandType.Text;
            dataCommand.ExecuteNonQuery();
            transakcija.Commit();
            MessageBox.Show("Registracija uspešna!");
        }
        catch (Exception eks)
        {
            transakcija.Rollback();
            MessageBox.Show("Napaka pri registraciji\n" + eks.Message);
        }
        finally
        {
            dataCommand.Connection.Close();
        }
    }

Answer 1

There are two things I immediately see wrong here...

First, you're using back ticks to wrap your values. In MySQL Back ticks represent database objects, so the query is looking for objects named by those values instead of using the values themselves. So instead of this:

`"+this.tB_upIme.Text+"`

You'd want this:

'"+this.tB_upIme.Text+"'

Second, and vastly more importantly, your code is wide open to SQL injection attacks. You'll want to use query parameters, not direct string concatenation. While it may look like you're just putting values into the query string, you're actually taking user input and treating it as executable code in your query string, which means users can run any arbitrary code they want on your database.

First, add parameters to your query:

"Insert INTO lr.users (upIme,geslo) VALUES (@upIme, @geslo)"

(You'll notice this also makes the query a heck of a lot cleaner and easier to read.) Then add your parameters to the command:

dataCommand.Parameters.AddWithValue("@upIme", this.tB_upIme.Text);
dataCommand.Parameters.AddWithValue("@geslo", this.tB_geslo.Text);

Then when you execute that command it will treat the user-input values as values instead of as executable code .

Answer 2

Change to single quotes ' in the values.

dataCommand.CommandText = 
"Insert INTO lr.users (upIme,geslo) 
VALUES ('"+this.tB_upIme.Text+"','"+this.tB_geslo.Text+"');";