c# - 系统.Data.SqlClient.SqlException : 'Invalid column name ' '

Question

我正在尝试从 visual studio 插入数据库表，但我遇到了同样的错误，我不知道它会是什么。

System.Data.SqlClient.SqlException: 'Invalid column name'

这是我的代码，我制作了 2 个类，Gateway、Dept 和 Form1:

namespace insertar
{
    class Dept
    {   
        public string Dept_No { get; set; }
        public string DNombre { get; set; }
        public string Loc { get; set; }
    }
}

---

using System;
using System.Collections.Generic;
using System.Data.SqlClient;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace insertar
{
    class Gateway
    {
        public bool Save(Dept dept)
        {
            Form1 form = new Form1();

            string connectionString = @"Data Source=DESKTOP-IE39262;Initial Catalog=Hospital;Integrated Security=True";
            SqlConnection connection = new SqlConnection(connectionString);
            //connection.Open();

            /*string query = @"INSERT INTO Dept VALUES (" + dept.Dept_No + "," + dept.DNombre +
                             "," + dept.Loc + ")";*/

            SqlCommand command = new SqlCommand("INSERT INTO Dept(Dept_No, DNombre, Loc)" + "VALUES (" + dept.Dept_No + "," + dept.DNombre +
                             "," + dept.Loc + ")", connection);
            connection.Open();
            command.ExecuteNonQuery();
            connection.Close();

            return true;
        }
    }
}

---

private void guardarbtn_Click(object sender, EventArgs e)
{
    Dept dept = new Dept();
    dept.Dept_No = dept_no.Text;
    dept.DNombre = dnombre.Text;
    dept.Loc = loc.Text;

    Gateway gateaway = new Gateway(); //class gateway
    gateaway.Save(dept);

    MessageBox.Show("Departamento insertado exitosamente");

    dept_no.Text = "";
    dnombre.Text = "";
    loc.Text = "";
}

Answer 1

您的插入值导致的错误是一个字符串，因此您需要使用' 来包含您的值。

但是有一个比它大的问题SQL-Injection .

我建议您使用参数而不是连接的 SQL 语句字符串。

确保您的参数数据类型大小与您的表架构相同。

string connectionString = @"Data Source=DESKTOP-IE39262;Initial Catalog=Hospital;Integrated Security=True";
string sqlQuery = "INSERT INTO Dept (Dept_No, DNombre, Loc) VALUES (@Dept_No,@DNombre,@Loc)";
using (SqlConnection connection = new SqlConnection(connectionString))
using (SqlCommand command = new SqlCommand(sqlQuery, connection))
{
    command.Parameters.Add("@Dept_No", SqlDbType.VarChar,100).Value = dept.Dept_No;
    command.Parameters.Add("@DNombre", SqlDbType.VarChar, 100).Value = dept.DNombre;
    command.Parameters.Add("@Loc", SqlDbType.VarChar, 100).Value = dept.Loc;
    connection.Open();
    command.ExecuteNonQuery();
}

注意

我会使用 using 语句，因为 Using 语句的目的是当控制到达 using 结束时，它将处理 using block 的对象并释放内存。它的目的不仅是为了自动关闭连接，基本上它会处理连接对象，显然，连接也会因此而关闭。

根据 MSDN :

As a rule, when you use an IDisposable object, you should declare and instantiate it in a using statement. The using statement calls the Dispose method on the object in the correct way, and (when you use it as shown earlier) it also causes the object itself to go out of scope as soon as Dispose is called. Within the using block, the object is read-only and cannot be modified or reassigned.

The using statement ensures that Dispose is called even if an exception occurs while you are calling methods on the object. You can achieve the same result by putting the object inside a try block and then calling Dispose in a finally block; in fact, this is how the using statement is translated by the compiler. The code example earlier expands to the following code at compile time (note the extra curly braces to create the limited scope for the object):

因此您可以减少代码 connection.Close(); 因为 using 会帮助您做到这一点。