如何使用 C# 将数据插入 SQL 表并实现上传功能？答案

【问题标题】：How do I to insert data into an SQL table using C# as well as implement an upload function?如何使用 C# 将数据插入 SQL 表并实现上传功能？
【发布时间】：2014-04-25 19:37:39
【问题描述】：

下面是我尝试将数据插入到“ArticlesTBL”表中的代码。我还想将图像文件上传到我的计算机。

我收到一条错误消息：“UploadedUserFiles”附近的语法不正确。

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.IO;
using System.Data;
using System.Data.SqlClient;
using System.Web.Configuration;

public partial class _CopyOfSubmitArticle : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{

}

protected void uploadbutton_Click(object sender, EventArgs e)
{
    string UpPath = Server.MapPath("~/UploadedUserFiles");

        int imgSize = FileUpload1.PostedFile.ContentLength;
        string imgName = FileUpload1.FileName;
        string imgPath = "UploadedUserFiles/" + imgName;

        if (FileUpload1.PostedFile.ContentLength > 1000000)
        {
            Page.ClientScript.RegisterClientScriptBlock(typeof(Page), "Alert", "alert('File is too big')", true);
        }

        else
        {
            FileUpload1.SaveAs(Server.MapPath(imgPath));
            myinfo.Text = "file" + imgPath + "uploaded.";
        }



    String connectionString = WebConfigurationManager.ConnectionStrings["ConnectAntiFrack"].ConnectionString;

    SqlConnection myConnection = new SqlConnection(connectionString);

    myConnection.Open();

    string ArticleImg = "UploadedUserFiles/" + FileUpload1.FileName;
    string ArticleTitle = ArticleTitleTextBox.Text;
    string ArticleContent = ArticleContentTextBox.Text;
    string ArticleType = ArticleTypeDropdown.Text.ToString();
    string ArticleAuthor = ArticleAuthorTextBox.Text.ToString();
    string ArticleBrief = ArticleBriefTextBox.Text;
    string ArticleDateTime = DateTime.Now.ToShortTimeString();

    string query = "INSERT INTO ArticlesTBL (ArticleTitle, ArticleContent, ArticleType, ArticleImg, ArticleBrief,  ArticleDateTime, ArticleAuthor, ArticlePublished, ArticleHomeDisplay, ArticleViews) VALUES (" + ArticleTitle +", " + ArticleContent +", "+ ArticleType +" " + ArticleImg +", "+ ArticleBrief +"," + ArticleDateTime + ", "+ ArticleAuthor +",'False', 'False', '0')";

    SqlCommand myCommand = new SqlCommand(query, myConnection);

    myCommand.ExecuteNonQuery();

    //       myinfo.Text = "connection to db is made";
    myConnection.Close();

}

【问题讨论】：

您的问题是什么？什么不工作？顺便说一句，你应该使用parameterized queries来避免SQL注入攻击。
这个错误是因为你忘记了ArticleType和ArticleImg之间的逗号，在执行之前调试并查看字符串query。不过，您确实应该使用参数化查询。

标签： c# sql database file-upload

【解决方案1】：

您应该在查询中使用参数来防止攻击，例如有人输入 '); drop table ArticlesTBL;--' 作为值之一。

string query = "INSERT INTO ArticlesTBL (ArticleTitle, ArticleContent, ArticleType, ArticleImg, ArticleBrief,  ArticleDateTime, ArticleAuthor, ArticlePublished, ArticleHomeDisplay, ArticleViews)";
query += " VALUES (@ArticleTitle, @ArticleContent, @ArticleType, @ArticleImg, @ArticleBrief, @ArticleDateTime, @ArticleAuthor, @ArticlePublished, @ArticleHomeDisplay, @ArticleViews)";

SqlCommand myCommand = new SqlCommand(query, myConnection);
myCommand.Parameters.AddWithValue("@ArticleTitle", ArticleTitleTextBox.Text);
myCommand.Parameters.AddWithValue("@ArticleContent", ArticleContentTextBox.Text);
// ... other parameters
myCommand.ExecuteNonQuery();

(xkcd)

【讨论】：

你只需要在调用myCommand.ExecuteNonQuery()之前打开连接；

【解决方案2】：

using System;
using System.Data;
using System.Data.SqlClient;

namespace InsertingData
{
    class sqlinsertdata
    {
        static void Main(string[] args)
        {
            try
            { 
            SqlConnection conn = new SqlConnection("Data source=USER-PC; Database=Emp123;User Id=sa;Password=sa123");
            conn.Open();
                SqlCommand cmd = new SqlCommand("insert into <Table Name>values(1,'nagendra',10000);",conn);
                cmd.ExecuteNonQuery();
                Console.WriteLine("Inserting Data Successfully");
                conn.Close();
        }
            catch(Exception e)
            {
                Console.WriteLine("Exception Occre while creating table:" + e.Message + "\t"  + e.GetType());
            }
            Console.ReadKey();

    }
    }
}

【讨论】：