查询在未准备的语句中返回ODBC错误“参数太少”

Question

I'm trying to run this code from the ASP.Net code:

string strupdate = "Insert into registers(user, module, event_type)" +
    "values (" +
    "'" + user + "'," +
    "'" + event + "'," +
    "'" + source + "');";

/* connSQL it's the ODBC connection type: System.Data.Odbc.OdbcConnection */
connSQL.ExecuteNonQuery();

The query results into the following:

Insert into registers(user, module, event_type)values('user01','message','control');

Running this query from psql works perfectly fine, but running from the web returns the ODBC 07002 error with the following message: The # of binded parameters < the # of parameter markers

Answer 1

There is a typo in the "'" + event + "," + code, it should be "'" + event + "'," + .

ie, ending single quote was missed in the second parameter value.

Note: Your code is possible for SQL Injection attack. Please convert the code with parameterised values.