从用户在asp.net C＃中输入的数据向SQL Server数据库添加行

Question

string ConnectionString = WebConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
SqlConnection connection = new SqlConnection(ConnectionString);

SqlCommand cmd = new SqlCommand("INSERT INTO Data (Name, Sur-Name, Score,Avg) VALUES ('" + fName + "','" + sName + "','" + lblScore.Text + "','" + lblAvg.Text + "');");
cmd.CommandType = CommandType.Text;
cmd.Connection = connection;
cmd.Parameters.AddWithValue("@Name", fName);
cmd.Parameters.AddWithValue("@Sur-Name", sName);
cmd.Parameters.AddWithValue("@Score", lblScore.Text);
cmd.Parameters.AddWithValue("@Avg", lblAvg.Text);

try
{
    connection.Open();
    cmd.ExecuteNonQuery();
}
catch (Exception exc)
{
    lblData.Text = exc.Message;              
}
finally
{
    connection.Close();
}

The error I keep getting is a runtime saying

Incorrect syntax near '-'. Incorrect syntax near '-'.

I used the try catch just so page would load and my scores show but the label says this Incorrect syntax as well, I was wondering could anyone please help me with what I am doing wrong

Thanks.

Answer 1

I think Sur-Name breaks your query. Use it with square brackets like [Sur-Name]

But more important, please use parameterized queries . This kind of string concatenations are open for SQL Injection attacks. I see you tried to use but you never declare your parameter names in your query.

Also DATA might be a reserved keyword on future versions of SQL Server. You might need to use with also like [DATA]

Consider to use using statement to dispose your SqlConnection and SqlCommand .

using(SqlConnection connection = new SqlConnection(ConnectionString))
using(SqlCommand cmd = connection.CreateCommand())
{
   cmd.CommandText = @"INSERT INTO [Data] (Name, [Sur-Name], Score, Avg)
                       VALUES (@Name, @SurName, @Score, @Avg)";
   cmd.Connection = connection;
   cmd.Parameters.AddWithValue("@Name", fName);
   cmd.Parameters.AddWithValue("@SurName", sName);
   cmd.Parameters.AddWithValue("@Score", lblScore.Text);
   cmd.Parameters.AddWithValue("@Avg", lblAvg.Text);

   try
   {
        connection.Open();
        cmd.ExecuteNonQuery();
   }
   catch (Exception exc)
   {
        lblData.Text = exc.Message;
   }     
}

Answer 2

You are trying to mix concatenated queries with parametrized. Always use parametrized queries, It will save you from SQL Injection.

SqlCommand cmd = new SqlCommand(@"INSERT INTO [Data] (Name, [Sur-Name], Score,Avg) VALUES (
                                  @Name, @SurName, @Score, @Avg)");
cmd.CommandType = CommandType.Text;
cmd.Connection = connection;
cmd.Parameters.AddWithValue("@Name", fName);
cmd.Parameters.AddWithValue("@SurName", sName);
cmd.Parameters.AddWithValue("@Score", lblScore.Text);
cmd.Parameters.AddWithValue("@Avg", lblAvg.Text);

Also consider enclosing your connection and command object in using statement.

As @Soner has mentioned in his answer , use Square brackets for Data and Sur-Name