插入DateTime（从C＃到MySQL）

Question

I Just Keep Having this Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '2014-10-08 19:39:57)' at line 1

    public string ObtenerFechaHora()
    {
        string query = "select CURRENT_TIMESTAMP() as Fecha";
        OpenConnection();
        MySqlCommand cmd = new MySqlCommand(query, connection);

        cmd.ExecuteNonQuery();
        DateTime e = (DateTime)cmd.ExecuteScalar();

        CloseConnection();
        return e.ToString("yyyy-MM-dd H:mm:ss");
    }

Then i insert ("Fecha" is the DateTime Column)

    string query = "INSERT INTO actividad (idTerminal, Proceso, Nombre, Tiempo, Fecha) VALUES('" + idTerminal + "', '" + Proceso + "', '" + Nombre + "', '1,'" + this.ObtenerFechaHora() + ")";

I been used loot of formats and i keep having error, for example:

    e.ToString("yyyy-MM-dd H:mm:ss");
    e.ToString("yyyy-MM-dd HH:mm:ss");
    e.ToString("dd-MM-yyyy H:mm:ss");
    e.ToString("yyyy-dd-MMH:mm:ss");

Also with "/" instead of "-" Any help here?

Answer 1

The problem isn't with the format of the datetime string; the problem is in the SQL text of the INSERT statement, right before the value is appended. For debugging this, you could output the query string and inspect it.

The problem is in the SQL text here:

  + "', '1,'" +

There needs to be a comma between that literal and the next column value. It looks like you just missed a single quote:

  + "', '1','" +
          ^

---

A potentially bigger problem is that your code appears to be vulnerable to SQL Injection. Consider what happens when one of the variables you are including into the SQL text includes a single quote, or something even more nefarios ala Little Bobby Tables. http://xkcd.com/327/ .

If you want a column value to be the current date and time, you don't need to run a separate query to fetch the value. You could simply reference the function NOW() in your query text. eg

  + "', '1', NOW() )";

Answer 2

You excuted twice

//cmd.ExecuteNonQuery();
DateTime e = (DateTime)cmd.ExecuteScalar();

Should be only one time.

Then like @sgeddes said in the comments use parameterized queries, they avoid errors and sql injections.

Answer 3

The approach that you have used is not the best approach to write SQL command. You should use sql parameters in the Query. Your code is vulnerable to SQL Injected and obviously it is not the best approach.

Try using something like this:

string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
    + "WHERE CustomerID = @ID;";
SqlCommand command = new SqlCommand(commandText, connection);
command.Parameters.Add("@ID", SqlDbType.Int);
command.Parameters["@ID"].Value = customerID;