什么由于标准表达式C＃中的数据类型不匹配而失败？

Question

am trying to develop ac# standalone application and my insert code has no error but when i click it will insert to first table or crtPro perfectly but it didn't add to the second table , can anyone give me some hint...??? here is my code for insert code...

 private void button1_Click(object sender, EventArgs e)
    {

         System.Data.OleDb.OleDbConnection conn = new System.Data.OleDb.OleDbConnection();
        conn.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;" +
        @"Data source= C:\Documents and Settings\abel\My Documents\Visual Studio 2010\Projects\WindowsFormsApplication1\WindowsFormsApplication1\crt_db.accdb";
        try
        {
            conn.Open();
            String Name = txtName.Text.ToString();

            String Address = txtAddress.Text.ToString();    

            //String Wereda = txtWereda.Text.ToString();
            //String Kebele = txtKebele.Text.ToString();
            //String House_No = txtHouse.Text.ToString();
            //String P_O_BOX = txtPobox.Text.ToString();

            String Tel = txtTel.Text.ToString();
            //String Fax = txtFax.Text.ToString();
            String Email = txtEmail.Text.ToString();
            String Item = txtItem.Text.ToString();
            String Dep = txtDep.Text.ToString();
            String Status = ToString();
            String Remark = txtRemark.Text.ToString();

            String Type = txtType.Text.ToString();
            String Brand = txtBrand.Text.ToString();
            String License_No = txtlicense.Text.ToString();
            String Date_issued = txtDate.Text.ToString();
            String my_querry = "INSERT INTO crtPro(Name,Address,Email,Tel,Item,Dep,Status,Remark)VALUES('" + Name + "','" + Address + "','" + Email + "','" + Tel + "','" + Item + "','" + Dep + "','" + Remark + "')";
            OleDbCommand cmd = new OleDbCommand(my_querry, conn);
            cmd.ExecuteNonQuery();
            conn.Close();
            conn.Open();

            String my_querry1 = "SELECT LAST(PID) FROM crtPro";
            OleDbCommand cmd1 = new OleDbCommand(my_querry1, conn);
            string var = cmd1.ExecuteScalar().ToString();
            //txtStatus.Text = var;
            String PID = ToString();
            String my_querry2 = "INSERT INTO crtItemLicense(PID,Type,Brand,License_No,Date_issued)VALUES('" +PID + "','" + Type + "','" + Brand + "','" + License_No + "','" + Date_issued + "')";
            OleDbCommand cmd2 = new OleDbCommand(my_querry2, conn);
            cmd2.ExecuteNonQuery();
            MessageBox.Show("Message added succesfully");
                    }


        catch (Exception ex)
        {
            MessageBox.Show("Failed due to" + ex.Message);
        }

        finally
        {
            conn.Close();

        }


    }

Answer 1

There are a couple of calls like:

String PID = ToString();

That will try to get a string representation of 'this', which is your form. That is probably not what you want to be inserting into the database. You probably meant

String PID = var.ToString();

If that isn't it, then try putting more tracewrites (or using a debugger) to narrow the problem down to find which one of your sql statements is causing the problem.

Also once you have it working, try entering this in the name field of your form:

   Robert"); DROP TABLE crtPro;--

and then do some googling about SQL injection (apologies to XKCD ).