无法使用C＃将数据插入SQL数据库

Question

I'm writing a method to insert a Student into a local SQL database that contains a table with information about Students:

public void AddStudent(string name, string teachName, string pass)
{
    string dbfile = new System.IO.FileInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).DirectoryName + "\\Logo.sdf";
    SqlCeConnection connection = new SqlCeConnection("Data Source=" + dbfile + "; Password = 'dbpass2011!'");
    connection.Open();

    SqlCeTransaction transaction = connection.BeginTransaction();
    SqlCeCommand command = connection.CreateCommand();
    command.Transaction = transaction;
    command.CommandText = "INSERT INTO Students VALUES ('@name', '@id', '@pass', '@tname')";
    command.Parameters.Add("@name", name);
    command.Parameters.Add("@id", this.ID);
    command.Parameters.Add("@pass", MD5Encrypt.MD5(pass));
    command.Parameters.Add("@tname", teachName);


    command.Prepare();
    command.ExecuteNonQuery();
    transaction.Commit();
    connection.Dispose();
    connection.Close();
}

Whenever I use this, it never inserts the data to the table when I look at the contents of the Students table in the database. Originally I had this return an int so I could see how many rows it affected, which it always returned 1, so I know it's working.

I've looked for answers to this, and the answer to similar questions was that the person asking was looking at the wrong .sdf file. I've made sure that I'm looking at the right file.

Any feedback would be much appreciated!

Answer 1

command.CommandText = "INSERT INTO Students VALUES ('@name', '@id', '@pass', '@tname')";

You should remove the extra single quotes - this should be:

command.CommandText = "INSERT INTO Students VALUES (@name, @id, @pass, @tname)";

Also I am not sure why you open a transaction for a single insert - that is also not needed.

Answer 2

There is most likely an exception being raised in your code; you need to add a try/catch handler and/or debug the application to figure out exactly what is happening.

However, there are at least two issues with your code:

• The prepare statement requires the data types of the parameters. From the MSDN documentation :

Before you call Prepare, specify the data type of each parameter in the statement to be prepared. For each parameter that has a variable-length data type, you must set the Size property to the maximum size needed. Prepare returns an error if these conditions are not met.

• You need to close the connection before disposing it (this won't affect the insert, however).

Answer 3

You don't need to put single quote to parametrized query, in case of parametrized query the whole data will be parsed as required,

command.CommandText = "INSERT INTO Students VALUES (@name, @id, @pass, @tname)";

Also, its better to set parameter type, size and value explicitly as below:

SqlCeParameter param = new SqlCeParameter("@name", SqlDbType.NVarChar, 100);
param.Value  = name; // name is a variable that contain the data of name field
//param.Value  = 'Jhon Smith';  //Directly value also can be used

Hope this would be helpful, thanks for your time.