关于SQL语句的语法，我错过了什么？

Question

I am writing code to insert a username and password into a database called Users.

When I try to run the code it says there is an error in the INSERT statement's syntax but I cannot for the life of me find it.

I am running the SQL statement using another function called RunSQL that I can submit if need be but its worked fine with every other SQL statement I have run with it.

The Users table has the following columns with their data type User_ID - Auto Number (Primary Key) Username - Short Text Password - Short Text

I have tried adding ' ' around the values I am going to insert into the table as well as removing the & and making it one continuous string. I have tried adding / removing the ; but nothing has worked.

Dim sql As String = "INSERT INTO Users (Username, Password) " &           
"VALUES (" & username_Textbox.Text & " , " & password_Textbox.Text & ");"
RunSQL(sql)
MessageBox.Show("User Added")

Private Sub RunSQL(ByVal sql As String)
    Dim conn As OleDbConnection = New 
    OleDbConnection("Provider=Microsoft.ACE.OLEDB.12.0;Data Source=Paper_Gen_Database.accdb;")
    conn.Open()
    Dim cmd As New OleDbCommand(sql, conn)
    cmd.ExecuteNonQuery()
    System.Threading.Thread.Sleep(500)
End Sub

The code should take the values from the username and password textboxes and insert them into the Users table but so far it has only thrown back an SQL error.

This is what the SQL statement looks when with "bh106" being the Username and "ZLTga" being the Password

Answer 1

This is one way to use parameters. It is very important to use parameters because otherwise you risk SQL injection which can ruin your database. It is actually much easier to write the SQL statement this way because you don't have to worry about if you have all your quotes in the string correctly.

The Using...End Using blocks ensure that your database objects are closed and disposed even if there is an error. This is important because it releases any unmanaged resources being used.

In a real application you would never save passwords as plain text but that is a subject for another day.

Private Sub InsertUser()
    Dim sql As String = "INSERT INTO Users (Username, [Password]) VALUES (@username, @password);"
    Using conn As OleDbConnection = New OleDbConnection("Provider=Microsoft.ACE.OLEDB.12.0;Data Source=Paper_Gen_Database.accdb;")
        Using cmd As New OleDbCommand(sql, conn)
            cmd.Parameters.Add("@username", OleDbType.VarChar).Value = username_Textbox.Text
            cmd.Parameters.Add("@password", OleDbType.VarChar).Value = password_Textbox.Text
            conn.Open()
            cmd.ExecuteNonQuery()
        End Using
    End Using
    MessageBox.Show("User Added")
End Sub

In Access the order that the parameters are added must match the order that they appear in the SQL statement.

Answer 2

Try this (its probably because of lack of quotes, and also because password is protected word):

Dim sql As String = "INSERT INTO Users (Username, [Password]) " &           
"VALUES ('" & username_Textbox.Text & "' , '" & password_Textbox.Text & "');"
RunSQL(sql)
MessageBox.Show("User Added")

Also be aware of sql injection problem. If a user will put a quote inside a textbox, insert will still fail.

You should try converting your code into parametrized query, example:

https://docs.microsoft.com/pl-pl/dotnet/api/system.data.oledb.oledbcommand.parameters?view=netframework-4.7.2