c＃，ado.net，Asp.net

Question

protected void dgMenuSubItems_ItemCommand(object source, DataGridCommandEventArgs e)
{
    try
    {
        if (!(e.CommandName == "AddANewRow"))
            return;

        string str1 = this.dgMenuItems.DataKeys[this.dgMenuItems.SelectedIndex].ToString();

        TextBox textBox1 = e.Item.FindControl("txtSubItemNameF") as TextBox;
        TextBox textBox2 = e.Item.FindControl("txtSubItemPriceF") as TextBox;
        TextBox textBox3 = e.Item.FindControl("txtSubItemSortOrderF") as TextBox;

        if (textBox1 != null && textBox2 != null)
        {
            int num = Convert.ToInt32(clsADO.getSingleRecord("Select Max(SubItemId) from tbl_MenuSubItems"));
            string text1 = textBox1.Text;
            string text2 = textBox2.Text;
            string str2 = text1.Replace("''", "''");
            string str3;

            try
            {
                str3 = Convert.ToInt32(textBox3.Text).ToString();
            }
            catch
            {
               str3 = "0";
            }

            clsADO.executeNonQuery("Insert into tbl_MenuSubItems values ('" + (object) (num + 1) + '",'" + str2 + "','" + text2 + "','" + str1 + "','" + str3 + "')");
        }
        else
            this.lblError.Text = "Error finding the SubItem";

        this.Rebuild_Sub_Display();
    }
    catch (Exception ex)
    {
        this.lblError.Text = ex.Message;
    }
}

在這里，我將值插入數據庫，但出現錯誤：

字符串'，0）'后的引號引起來。 '，0）'附近的語法不正確

我想我缺少引號了，但是我不知道我到底在哪里

Answer 1

您應該使用sqlcommand和sqlparameters完成所有操作。 無論如何，您的插入查詢必須是這樣的，您輸入了錯誤的字符串

Insert into tbl_MenuSubItems values ('" + (object) (num + 1) + "','" + str2 + "','" + text2 + "','" + str1 + "','" + str3 + "')

您的非查詢行必須是

clsADO.executeNonQuery("Insert into tbl_MenuSubItems values ('" + (object) (num + 1) + "','" + str2 + "','" + text2 + "','" + str1 + "','" + str3 + "')");