'/'附近的语法不正确

Question

cmSQL = New SqlCommand("UPDATE AdBanner SET AdBannerTitle='" & txTitle.Text & "',AdBannerFileUrl=/Images/'" & fileUpload.FileName & "',AdBannerTargerUrl='" & txTargetUrl.Text & "',AdBannerIsActive='" & chkBox.Checked & "' WHERE AdBannerID='" & lblBannerId.Text & "'", cnSQL)

Error:Incorrect syntax near '/'.

i got that error when updating record

Answer 1

You must put the quotation mark ( ' ) before /Images/ . Change your statement to this:

cmSQL = New SqlCommand("UPDATE AdBanner SET AdBannerTitle='" & txTitle.Text _
        & "',AdBannerFileUrl='/Images/" & fileUpload.FileName _
        & "',AdBannerTargerUrl='" & txTargetUrl.Text _
        & "',AdBannerIsActive='" & chkBox.Checked _
        & "' WHERE AdBannerID='" & lblBannerId.Text & "'", cnSQL)

And when you're done with that, I'd recommend you start learning about SQL Injection immediately. It's a simple but dangerous security hazard.

Answer 2

The immediate problem is that you aren't creating a valid literal for AdBannerFileUrl ; however! Your approach at the moment is deadly . Please see "SQL injection". You should parameterize that, then it becomes:

cmSql = new SqlCommand("UPDATE AdBanner SET AdBannerTitle=@Title,AdBannerFileUrl=@FileUrl,AdBannerTargerUrl=@TargetUrl,AdBannerIsActive=@IsActive WHERE AdBannerID=@ID", cnSQL)

However! You must then add parameters for each of those:

cmSql.Parameters.AddWithValue("@Title", txtTitle.Text);
cmSql.Parameters.AddWithValue("@FileUrl", "/Images/" + fileUpload.FileName);
cmSql.Parameters.AddWithValue("@TargetUrl", txTargetUrl.Text);
cmSql.Parameters.AddWithValue("@IsActive", chkBox.Checked);
cmSql.Parameters.AddWithValue("@ID", lblBannerId.Text);

Answer 3

You are missing a ' before the /Images/ part, so the SQL that SQL Server gets is malformed.

However, doing a concatenation based SQL on the server, in this day and age, is, to put it bluntly, stupid, especially when using unvalidated user-suplied values (like txTitle.Text)

A better approach would be:

cmSQL = New SqlCommand("UPDATE AdBanner SET AdBannerTitle=@AdBannerTitle" _
    & ", AdBannerFileUrl=@AdBannerFileUrl" _
    & ", AdBannerTargerUrl=@AdBannerTargerUrl" _
    & ", AdBannerIsActive=@AdBannerIsActive" _
    & " WHERE AdBannerID=@AdBannerID", cnSQL)
cmSQL.CommandType = CommandType.Text;

cmSQL.Parameters.AddWithValue("@AdBannerTitle", txTitle.Text)
cmSQL.Parameters.AddWithValue("@AdBannerFileUrl", "/Images/" & fileUpload.FileName)
cmSQL.Parameters.AddWithValue("@AdBannerTargerUrl", txTargetUrl.Text)
cmSQL.Parameters.AddWithValue("@AdBannerIsActive", chkBox.Checked)
cmSQL.Parameters.AddWithValue("@AdBannerID", lblBannerId.Text)

Answer 4

your single quotes are misplaced.

your code must be

    cmSQL = New SqlCommand("UPDATE AdBanner SET AdBannerTitle='" & txTitle.Text & "',AdBannerFileUrl='/Images/" & fileUpload.FileName & "',AdBannerTargerUrl='" & txTargetUrl.Text & "',AdBannerIsActive='" & chkBox.Checked & "' WHERE AdBannerID='" & lblBannerId.Text & "'", cnSQL)