如何将数据RSS插入数据库

Question

I need insert in DB the values of xslt file and I tried this code. I don't have error in debug but the insertion not executed.

I would greatly appreciate any help you can give me in working this problem, thank you.

Code:

Stream stream = resp.GetResponseStream();

XmlTextReader reader = new XmlTextReader(stream);
reader.XmlResolver = null;

XmlDocument doc = new XmlDocument();
doc.Load(reader);

xmlRSS.Document = doc;

XmlNodeList dataNodes = doc.SelectNodes("/title");

OdbcCommand command;
OdbcDataAdapter adpter = new OdbcDataAdapter();

foreach (XmlNode node in dataNodes)
{
    string title = node.SelectSingleNode("title").InnerText;

    string sql = "insert into Product values(" + title.ToString() + ")";
    command = new OdbcCommand(sql, connection);
    adpter.InsertCommand = command;
    adpter.InsertCommand.ExecuteNonQuery();
}

XSLT file:

<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:output method="html" indent="yes"/>
  <xsl:param name="title"/>
  <xsl:template match="rss">
    <xsl:for-each select="channel/item">
      <br>
        <strong>
          <a href="{link}" target="_main">
            <xsl:value-of select="title"/>
          </a>
        </strong>
        <br></br>
        <xsl:value-of select="description" disable-output-escaping="yes"/>
      </br>
      <br></br>
      <xsl:value-of select="pubDate"/>
      <br></br>
    </xsl:for-each>
  </xsl:template>
  <xsl:template match="description">
    <br>
      <xsl:value-of select="."/>
    </br>
  </xsl:template>
</xsl:stylesheet>

New version for SQL Injection but in DB register only title of XSLT file:

foreach (XmlNode node in dataNodes)
{
    string titlenew = node.SelectSingleNode("//title").InnerText;
    string descriptionnew = node.SelectSingleNode("//description").InnerText;
    string pubDatenew = node.SelectSingleNode("//pubDate").InnerText;
    string sql = "insert into Product (title, description, pubdate) values (?,?, STR_TO_DATE(?, '%a, %d %b %Y %H:%i:%s GMT'));";

    connection.Open();
    command = new OdbcCommand(sql, connection);
    command.Parameters.AddWithValue("param1", titlenew.ToString());
    command.Parameters.AddWithValue("param2", descriptionnew.ToString());
    command.Parameters.AddWithValue("param3", pubDatenew.ToString());
    adpter.InsertCommand = command;
    adpter.InsertCommand.ExecuteNonQuery();
    connection.Close();
}

This is the RSS file on the browser (view source).

I need insert in DB the values:

1. For title: News, ASP.NET & Web Development and In Focus;
2. For description: News, ASP.NET & Web Development and In Focus;
3. For Pubdate: Fri, 04 Apr 2014 13:57:16 GMT, Wed, 26 Feb 2014 09:39:00 GMT and Wed, 26 Feb 2014 09:39:00 GMT

My code now insert in DB only:

1. For title: News;
2. For description: News;

3. For Pubdate: Fri, 04 Apr 2014 13:57:16 GMT.

    <title>News</title> <link>http://.... <description>News</description> <pubDate>Fri, 04 Apr 2014 13:57:16 GMT</pubDate> <dc:date>2014-04-04T13:57:16Z</dc:date> <image> <title>News</title> <url>http://....</url> <link>http://.... </image> <item> <title>ASP.NET & Web Development</title> <link>http://..... <description>ASP.NET & Web Development .....</description> <category> </category> <pubDate>Wed, 26 Feb 2014 09:39:00 GMT</pubDate> <guid isPermaLink="false">http://.....</guid> <dc:title>ASP.NET & Web Development</dc:title> <dc:creator> </dc:creator> <dc:description>ASP.NET & Web Development</dc:description> <dc:date>2014-02-26T09:39:00Z</dc:date> <dc:type>eip_news</dc:type> <dc:source>ASP.NET & Web Development</dc:source> <dc:language>us_US</dc:language> </item> <item> <title>In Focus</title> <link>http://..... <description>In Focus ..... </description> <category> </category> <pubDate>Wed, 26 Feb 2014 09:39:00 GMT</pubDate> <guid isPermaLink="false">http://.....</guid> <dc:title>In Focus</dc:title> <dc:creator> </dc:creator> <dc:description>In Focus</dc:description> <dc:date>2014-02-26T09:39:00Z</dc:date> <dc:type>eip_news</dc:type> <dc:source>In Focus</dc:source> <dc:language>us_US</dc:language> </item> 

Answer 1

I'd try to add quotes on your query, that is:

string sql = "insert into Product values('" + title.ToString() + "')";

Otherwise I think that the SQL parser is quite confused by quotes contained in your title string.

Answer 2

Thanks for the provided details (XML sample and so on).

Applying the XSLT you provided to the XML data you provide, a simple HTML page is obtained, consisting only of the list of RSS items (linked title, description and publication date).

But, if I am not wrong (looking at your example) you need a different thing: you want to insert in your database the title, description and publication date of all items but even of the RSS feed (the first title, description and pubDate you encounter in your XML file): I can't understand why you want to do that, but anyway this is what I understood about your requirements.

If so, then I think that the problem is not specifically in the part of code that handles the insertion of data into DB table, but instead in selection of data operated on XML file.

Here is my code (being xml your XML fragment):

XmlDocument xmlDoc = new XmlDocument();
xmlDoc.LoadXml(xml);

foreach (XmlNode xmlTitle in xmlDoc.SelectNodes("//title"))
{
    XmlNode xmlDescription = xmlTitle.ParentNode.SelectSingleNode("description");
    XmlNode xmlPubDate = xmlTitle.ParentNode.SelectSingleNode("pubDate");

    if (xmlDescription != null && xmlPubDate != null)
    {
        // Instead of printing to console PUT HERE your code to insert data into database

        Console.WriteLine(xmlTitle.InnerText);
        Console.WriteLine(xmlDescription.InnerText);
        Console.WriteLine(xmlPubDate.InnerText);
        Console.WriteLine();
    }
}

The output produced is the following:

News
News
Fri, 04 Apr 2014 13:57:16 GMT

ASP.NET & Web Development
ASP.NET & Web Development .....
Wed, 26 Feb 2014 09:39:00 GMT

In Focus
In Focus .....
Wed, 26 Feb 2014 09:39:00 GMT

which I think is what you need to fulfill your requirements.

Instead of dumping all those data to console, you simply have to use your own SQL-injection-safe code to put them into DB table.