在ASP.NET中使用C＃将数据添加到数据库

Question

I need to add things to my database using a txtbox and a button (btnAdd) this is my code, but the CommandType.Text; part has an error and I can't fix it.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;

namespace _21542890_F
{
     public partial class Add_Product : System.Web.UI.Page
    {
        SqlConnection con = new SqlConnection(@"Data Source=(LocalDB)\v11.0;AttachDbFilename=C:\Users\Dylan\Documents\Company.mdf;Integrated Security=True;Connect Timeout=30");
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void lbtnHome_Click(object sender, EventArgs e)
        {
            Response.Redirect("Home Page.aspx");
        }

        protected void btnAdd_Click(object sender, EventArgs e)
        {
            con.Open();
            SqlCommand cmd = con.CreateCommand();
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "insert into Company values('"+txtProductName.Text+"','"+txtProductPrice.Text+"')";
            cmd.ExecuteNonQuery();
            con.Close();
        }
    }
}

Answer 1

I would start with a string.format just to see where we are...

string.format("insert into Company values('{0}','{1}')", txtProductName.Text,
txtProductPrice.Text);

Answer 2

You shouldn't be referencing text fields directly in your query, but instead using paramaterized inputs to avoid injection. It keeps anyone from sending code/sql that is executable by itself.

Look into this example from Microsoft:

private static void UpdateDemographics(Int32 customerID,
    string demoXml, string connectionString)
{
    // Update the demographics for a store, which is stored  
    // in an xml column.  
    string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
        + "WHERE CustomerID = @ID;";

    using (SqlConnection connection = new SqlConnection(connectionString))
    {
        SqlCommand command = new SqlCommand(commandText, connection);
        command.Parameters.Add("@ID", SqlDbType.Int);
        command.Parameters["@ID"].Value = customerID;

        // Use AddWithValue to assign Demographics. 
        // SQL Server will implicitly convert strings into XML.
        command.Parameters.AddWithValue("@demographics", demoXml);

        try
        {
            connection.Open();
            Int32 rowsAffected = command.ExecuteNonQuery();
            Console.WriteLine("RowsAffected: {0}", rowsAffected);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }
}

It's a security issue. As far as your code currently; please include an error message/where it is breaking. As others have previous stated, if the columns you're inputting data into on your SQL server are not in order and/or there are more columns than you're inserting values into, you need to first tell the server which columns you're inserting values into.

This looks similar to:

"INSERT Region (RegionID, RegionDescription) VALUES (5, 'NorthWestern')";

In your current code it would be this:

cmd.CommandText = "insert into Company (Product_Name, Product_Price)  VALUES ('"+txtProductName.Text+"','"+txtProductPrice.Text+"')";

Passed those two items, we really need more information!

As far as your data goes though, why are you inserting product information into a company record? Unless there is a specific use case to what you're doing, you should think about normalizing and creating a product table to store that information in.

Answer 3

It may be problem with your SQL syntax, are you sure you have only those two columns inside Company table? If not, you need to specify column names, otherwise SQL statement will fail.