[英]How to store DateTime of .net in sql server 2008 R2
I am new to .net and sql. 我是.net和sql的新手。 I am trying to store the DateTime into database but i am getting exception as "Incorrect syntax near '11' " at 11:21:57 AM i run my code so, i am getting error at time.
我正在尝试将DateTime存储到数据库中,但我在上午11:21:57因为“11'附近的语法不正确”而异常我运行我的代码,所以我得到了错误。 This is my code for storing into database.
这是我存储到数据库中的代码。 Below method will return a query.
下面的方法将返回一个查询。
public string InsertADData(string strdateLogin, string strdateLogout, string strName, string strUsername)
{
DateTime dateLogin = Convert.ToDateTime(strdateLogin);
DateTime dateLogout = Convert.ToDateTime(strdateLogout);
return string.Format(@"INSERT INTO ADTimeData (LoginDate, LogoutDate,name,username)
VALUES ({0},{1},'{2}','{3}')", dateLogin,
dateLogout,
strName.Replace("'", "''"),
strUsername.Replace("'", "''"));
}
This method is for insert the records into database. 此方法用于将记录插入数据库。 Here CheckDBConnection() will open sql connection.
这里CheckDBConnection()将打开sql连接。
public void InsertRecords(String strQuery)
{
CheckDBConnection();
using (SqlCommand cmd = new SqlCommand())
{
cmd.Connection = _con;
cmd.CommandText = strQuery;
cmd.CommandType = CommandType.Text;
cmd.ExecuteNonQuery();
}
}
When i debug the code which i have written i am getting query ie sqlQuery value Like this 当我调试我写的代码我得到查询,即sqlQuery值像这样
INSERT INTO ADTimeData (LoginDate, LogoutDate,name,username)
VALUES (1/4/2013 11:21:57 AM,1/4/2013 11:21:57 AM,'raivnder','ravinder.g@gmail.com')
But i am getting exception at 但我得到了例外
cmd.ExecuteNonQuery();
The exception is shown in below image. 例外情况如下图所示。
Please help me. 请帮我。
In short: The issue is in datetime format that you are passing in insert statement. 简而言之:问题在于您在insert语句中传递的日期时间格式。
It should be done through a parametrized query. 它应该通过参数化查询来完成。 Something similare to the following sample query:
类似于以下示例查询的东西:
SqlCommand cmd = new SqlCommand("INSERT INTO <table> (<column>) VALUES (@value)", connection);
cmd.Parameters.AddWithValue("@value", dateTimeVariable);
cmd.ExecuteNonQuery();
By all means - use parametrized queries to avoid SQL injection attacks (and to speed up performance, too!): 通过各种方法 - 使用参数化查询来避免SQL注入攻击(并加快性能!):
public string InsertADData(string strdateLogin, string strdateLogout, string strName, string strUsername)
{
DateTime dateLogin = Convert.ToDateTime(strdateLogin);
DateTime dateLogout = Convert.ToDateTime(strdateLogout);
string query = @"INSERT INTO ADTimeData (LoginDate, LogoutDate,name,username)
VALUES (@LoginDate, @LogoutDate, @name, @username)";
using (SqlConnection conn = new SqlConnection(.....))
using (SqlCommand cmd = new SqlCommand(query, conn))
{
cmd.Parameters.Add("@LoginDate", SqlDbType.DateTime).Value = dateLogin;
cmd.Parameters.Add("@LogoutDate", SqlDbType.DateTime).Value = dateLogout;
cmd.Parameters.Add("@Name", SqlDbType.VarChar, 50).Value = name;
cmd.Parameters.Add("@UserName", SqlDbType.VarChar, 50).Value = username;
conn.Open();
cmd.ExecuteQuery();
conn.Close();
}
Never concatenate together your SQL statement with the values! 永远不要将SQL语句与值连接在一起! This is a really really horribly bad practice - stop doing that.
这是一个非常糟糕的做法 - 停止这样做。 You should always use parametrized queries - no exception
您应该始终使用参数化查询 - 没有例外
public string InsertADData(string strdateLogin, string strdateLogout, string strName, string strUsername)
{
DateTime dateLogin = Convert.ToDateTime(strdateLogin);
DateTime dateLogout = Convert.ToDateTime(strdateLogout);
return string.Format(@"INSERT INTO ADTimeData (LoginDate, LogoutDate,name,username)
VALUES ('{0}','{1}','{2}','{3}')", dateLogin,
dateLogout,
strName.Replace("'", "''"),
strUsername.Replace("'", "''"));
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.