為什么我的代碼不寫SQL？

Question

我正在編寫一個將文本存儲到SQL數據庫的應用程序，但是我的代碼引發了一個異常，說“變量名@ par1已經聲明”，我不確定如何使它正常工作，並希望獲得一些幫助來解決此問題如果可能，請=]

違規代碼如下

 private void SMSGetter()
    {
         try {

                DecodedShortMessage[] messages = Comm.ReadMessages(PhoneMessageStatus.All, PhoneStorageType.Sim);
                SqlConnection Conn = new SqlConnection("Data Source=*********;Initial Catalog=********;User ID=**********;Password=***********");
                SqlCommand com = new SqlCommand();
                com.Connection = Conn;
                Conn.Open();
                foreach (DecodedShortMessage message in messages)
                {

                    //com.CommandText = ("INSERT INTO SMSArchives(Message,Blacklist) VALUES ('" + message.Data.UserDataText + "', 'Yes')");
                    //com.ExecuteNonQuery();
                    com.CommandText = ("INSERT INTO SMSArchives(Message,Blacklist) VALUES (@par1,@par2)");
                    com.Parameters.AddWithValue("@par1", message.Data.UserDataText);
                    com.Parameters.AddWithValue("@par2", "Yes");
                    com.ExecuteNonQuery();
                }
                Conn.Close();

            }
            catch (Exception ex) {
                Log(ex.ToString());
            }
        }

Answer 1

每次迭代都使用相同的命令，但是每次都添加參數。 嘗試致電

com.Parameters.Clear();

在每個循環迭代結束時。 您還可以預先創建參數，並只需設置每次迭代的.Value可能略快一些。

另外：修復SQL注入孔:)

Answer 2

private void SMSGetter()
{

    Log("Getter Fired");

    //var message = GSM.ReadMessage(4);
    //GSM.ReadMessage(4);
    //TcpClientChannel client = new TcpClientChannel();
    //ChannelServices.RegisterChannel(client, false);
    //string url = "*******";
    //ISmsSender smssender = (ISmsSender)Activator.GetObject(typeof(ISmsSender), url);
           try
        {

            DecodedShortMessage[] messages = Comm.ReadMessages(PhoneMessageStatus.All, PhoneStorageType.Sim);
            SqlConnection Conn = new SqlConnection("Data Source=*********;Initial Catalog=********;User ID=**********;Password=***********");
            SqlCommand com = new SqlCommand();
            com.Connection = Conn;
            Conn.Open();
            com.CommandText = ("INSERT INTO SMSArchives(Message,Blacklist) VALUES (@par1,@par2)");
            com.Parameters.Add("@par1");
            com.Parameters.Add("@par2");
            foreach (DecodedShortMessage message in messages)
            {
                com.Parameters["@par1"].value = message.Data.UserDataText;
                com.Prepare(); //fix SQL injection :)
                com.ExecuteNonQuery();
            }


            Conn.Close();

        }

        catch (Exception ex)
        {

            Log(ex.ToString());

        }
    }

Answer 3

您將在foreach的每次迭代中添加參數。 考慮以下：

        com.CommandText = ("INSERT INTO SMSArchives(Message,Blacklist) VALUES (@par1,@par2)");
        command.Parameters.Add(new SqlParameter("@par1", ""));
        com.Parameters.AddWithValue("@par2", "Yes");
        foreach (DecodedShortMessage message in messages)
        {
            command.Parameters["@par1"].Value = message.Data.UserDataText;
            com.ExecuteNonQuery();
        }