System.Data.SqlClient.SqlException：''...'附近的语法不正确

Question

This is probably one of the common questions related to SQL however I am having hard time figuring out what is the issue.

My current code is giving an error:

An unhandled exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll Incorrect syntax near '...'.

SQL:

CREATE TABLE [dbo].[LTEST] (
    [Id]       INT  NOT NULL,
    [YRNRO]    INT  NULL,
    [HAKUNIMI] TEXT NULL,
    [NIMIA]    TEXT NULL,
    [NIMIB]    TEXT NULL,
    [KAYNTIOS] TEXT NULL,
    [POSTIOS]  TEXT NULL,
    [POSTINRO] TEXT NULL,
    PRIMARY KEY CLUSTERED ([Id] ASC)
);

C#:

        using (OdbcConnection dbConnection1 = new OdbcConnection(connectionString1))
        {
            dbConnection1.Open();
            OdbcDataAdapter dadapter1 = new OdbcDataAdapter();
            dadapter1.SelectCommand = new OdbcCommand(queryString1, dbConnection1);

            dadapter1.Fill(t1);

            SqlConnection tempDbConnection = new SqlConnection();
            tempDbConnection.ConnectionString = @"Data Source=(LocalDB)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\CustomerDatabase.mdf;Integrated Security=True";
            tempDbConnection.Open();

            string tempSql = "";
            for (int i = 0; i < t1.Rows.Count; i++)
            {
                tempSql = "INSERT INTO LTEST (YRNRO,HAKUNIMI,NIMIA,NIMIB,KAYNTIOS,POSTIOS,POSTINRO) VALUES ('"
                            + t1.Rows[i]["YRNRO"].ToString().Trim() + ",'"
                            + t1.Rows[i]["HAKUNIMI"].ToString().Trim() + "','"
                            + t1.Rows[i]["NIMIA"].ToString().Trim() + "','"
                            + t1.Rows[i]["NIMIB"].ToString().Trim() + "','"
                            + t1.Rows[i]["KAYNTIOS"].ToString().Trim() + "',"
                            + t1.Rows[i]["POSTIOS"].ToString().Trim() + "',"
                            + t1.Rows[i]["POSTINRO"].ToString().Trim() + ");'";
                SqlCommand tempCommand = new SqlCommand(tempSql, tempDbConnection);
                tempCommand.ExecuteNonQuery();
            }

        }

---

EDIT:

I have also had a problem with path, it should be: C:\Users\...\source\repos\...\...\CustomerDatabase.mdf

Answer 1

As others have mentioned, better try something like this:

var connectionString = @"Data Source=(LocalDB)\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\CustomerDatabase.mdf;Integrated Security=True";

string tempSql = "INSERT INTO LTEST (YRNRO,HAKUNIMI,NIMIA,NIMIB,KAYNTIOS,POSTIOS,POSTINRO) VALUES (@YRNRO, @HAKUNIMI, @NIMIA, @NIMIB, @KAYNTIOS, @POSTIOS, @POSTINRO)"
using (SqlConnection connection = new SqlConnection(connectionText))
{
    SqlCommand command = new SqlCommand(commandText, connection);
    command.Parameters.Add("@YRNRO", SqlDbType.Text);
    command.Parameters.Add("@HAKUNIMI", SqlDbType.Text);
    command.Parameters.Add("@NIMIA", SqlDbType.Text);
    command.Parameters.Add("@NIMIB", SqlDbType.Text);
    command.Parameters.Add("@KAYNTIOS", SqlDbType.Text);
    command.Parameters.Add("@POSTIOS", SqlDbType.Text);
    command.Parameters.Add("@POSTINRO", SqlDbType.Text);

    connection.Open();  
    for (int i = 0; i < t1.Rows.Count; i++)
    {
        command.Parameters["@YRNRO"].Value = t1.Rows[i]["YRNRO"].ToString().Trim();
        command.Parameters["@HAKUNIMI"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();
        command.Parameters["@NIMIA"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();
        command.Parameters["@NIMIB"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();
        command.Parameters["@KAYNTIOS"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();
        command.Parameters["@POSTIOS"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();
        command.Parameters["@POSTINRO"].Value = t1.Rows[i]["@HAKUNIMI"].ToString().Trim();

        try
        {
            command.ExecuteNonQuery();
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }
    connection.Close();
}

Answer 2

To answer your question, you have a missing single quote on this line:

 + t1.Rows[i]["YRNRO"].ToString().Trim() + ",'"
//change to
 + t1.Rows[i]["YRNRO"].ToString().Trim() + "','"

But as a responsible senior developer, I MUST tell you to either use parameterised SQL, or wrap your script in a stored procedure and pass it parameters.

And maybe off topic, but to speed up execution, generate a bulk SQL script, and then execute all at once instead of inside a foreach loop.