使用C＃将数据插入Access数据库无法正常工作

Question

I am trying to add data into an access database, so far this is what I have.

  try
        {
            connection.Open();

            String dataInsert = "INSERT into ClientsT (FirstName, LastName, Address, Email, Phone, CellPhone, Notes) values('" + boxAddName.Text.ToString() + "', '" + boxAddLastName.Text + "', '" + boxAddAdress.Text + "', '" + boxAddEmail.Text + "', '" + boxAddPhone + "', '" + boxAddCellPhone + "','" + boxAddObs.Text + "')";
            OleDbCommand command = new OleDbCommand(dataInsert, connection);


            command.ExecuteNonQuery();
            connection.Close();
            MessageBox.Show("Client added,");
        } catch(Exception ex){
            MessageBox.Show("Error :" + ex);
        }

    }

It does't give me any king of error menssage, the code executes just fine but nothing is added to the database.

Please note that I am farly new to c# and it's my first time working with databases.

Answer 1

Now hang on a minute there!

You are introducing a potentially disastrous security hole. Let me show you why:

String dataInsert = "INSERT into ClientsT (FirstName, LastName, Address, Email, Phone, CellPhone, Notes) values('" + boxAddName.Text.ToString() + "', '" + boxAddLastName.Text + "', '" + boxAddAdress.Text + "', '" + boxAddEmail.Text + "', '" + boxAddPhone + "', '" + boxAddCellPhone + "','" + boxAddObs.Text + "')";

In particular these lines:

boxAddName.Text.ToString() // You're converting a string to a string, which is redundant. :P You are also missing a semicolon here.
boxAddLastName.Text
boxAddAdress.Text
boxAddEmail.Text
boxAddPhone // Not a security problem, but you're inserting the TextBox control, not it's text.
boxAddCellPhone // Same as above.
boxAddObs.Text

What you're doing with this is basically allowing the user to put anything they want into the database. With this, the user can insert whatever they want, or even use an SQL injection exploit. You should always sanitize your input.

You could do something like this:

    string Query = "INSERT into ClientsT (FirstName, LastName, Address, Email, Phone, CellPhone, Notes) values(@FirstName, @LastName, @Address, @Email, @Phone, @CellPhone, @Notes)";

    using (SqlConnection connection = new SqlConnection(ConnectionString))
    using (SqlCommand cmd = new SqlCommand(Query))
    {
        connection.Open();

        // Please make sure you edit the SqlDbType to the correct SQL Data Type. They are VarChar by default in this example. It's on you to fix that.
        cmd.Parameters.Add("@FirstName", SqlDbType.VarChar) = boxAddName.Text;
        cmd.Parameters.Add("@LastName", SqlDbType.VarChar) = boxAddLastName.Text;
        cmd.Parameters.Add("@Address", SqlDbType.VarChar) = boxAddAddress.Text;
        cmd.Parameters.Add("@Email", SqlDbType.VarChar) = boxAddEmail.Text;
        cmd.Parameters.Add("@Phone", SqlDbType.VarChar) = boxAddPhone.Text;
        cmd.Parameters.Add("@CellPhone", SqlDbType.VarChar) boxAddCellPhone.Text;
        cmd.Parameters.Add("@Notes", SqlDbType.VarChar) = boxAddNotes.Text;

        // Insert writing code here.
    }

Your problem is simply this:

You're trying to insert the TextBox control on multiple occasions. Look at boxAddPhone , and boxAddCellphone : you need to use TextBoxName.Text , not TextBoxName . So it's going to throw an exception, and since you're catching ALL exceptions, you won't know what went wrong. It could be anything.

Finally, you're also adding boxAddObs , which is not inserted with the first INSERT INTO ClientsT (...) statement.

Answer 2

看起来“ boxAddPhone”和“ boxAddCellPhone”缺少“ .Text”