'fieldname'附近的SQL语法错误[关闭]

Question

我是 C# 的新手，我有一个数据库，我需要用 windows 窗体填充，将数据插入表的按钮具有以下代码：

private void btnAddEmployee_Click(object sender, EventArgs e)
        {
            SqlConnection cn = new SqlConnection("server=.\\server1; database = PMS; Integrated security=true;");
            SqlDataAdapter da = new SqlDataAdapter("INSERT INTO tblEmployees cid, empID, empFirstName, empMidName, "
                +"empLastName, empAge, empTitle, empAddress, empRank, empSalary, empEmail, empPhone, "
                +"empMobile, Notes, userName, usrPassword, usrAccessLevel, empActive, empMarked, empType "
                +"VALUES ('" + this.txtID + "', '" + this.txtEmpID + "', '" + this.txtFirstName + "','" + this.txtMidName + "'," +
                " '" + this.txtLastName + "', '" + this.txtEmpAge + "', '" + this.txtJobTitle + "', '" + this.txtAddress + "', " +
                " '" + this.cmbRank + "', '" + this.txtSalary + "', '" + this.txtEmail + "', '" + this.txtPhone + "', " + 
                " '" + this.txtMobile + "', '" + this.txtNote + "', '" + this.txtUserName + "', '" + this.txtPassword + "', " + 
                " '" + this.cmbAcsLevel + "', '" + this.txtActive + "', '" + this.txtMarked + "', '" + this.txtType + "')", cn);

        if (cn.State != ConnectionState.Open)
        {
            cn.Open();
        }
        object o = da.SelectCommand.ExecuteNonQuery();
        cn.Close();
    }

但是点击按钮后我得到以下错误：

System.Data.SqlClient.SqlException: 'cid' 附近的语法不正确。'

Answer 1

首先让它变得简单，使用Parameterized query来防止sql injection

     using(SqlConnection connection = new SqlConnection("server=.\\server1; database = PMS; Integrated security=true;"))
      {
     String query = "INSERT INTO tblEmployees (cid, empID, empFirstName, empMidName,empLastName, empAge, empTitle, empAddress, empRank, empSalary, empEmail, empPhone,empMobile, Notes, userName, usrPassword, usrAccessLevel, empActive, empMarked, empType) VALUES (@cid, @empID, @empFirstName, @empMidName,@empLastName, @empAge, @empTitle, @empAddress, @empRank, @empSalary, @empEmail, @empPhone,@empMobile, @Notes, @userName, @usrPassword, @usrAccessLevel, @empActive, @empMarked, @empType)";

using(SqlCommand command = new SqlCommand(query, connection))
{
    command.Parameters.AddWithValue("@cid", cid);
    command.Parameters.AddWithValue("@empID", empID);
    command.Parameters.AddWithValue(" @empFirstName", empFirstName);
    command.Parameters.AddWithValue("@empMidName", empMidName);

    command.Parameters.AddWithValue("@empLastName", empLastName);
    command.Parameters.AddWithValue("@empAge", empAge);
    command.Parameters.AddWithValue(" @empTitle", empTitle);
    command.Parameters.AddWithValue("@empAddress", empAddress);
    command.Parameters.AddWithValue("@empRank", empRank);
    command.Parameters.AddWithValue("@empSalary", empSalary);
    command.Parameters.AddWithValue(" @empEmail", empEmail);
    command.Parameters.AddWithValue("@empPhone", empPhone);
    command.Parameters.AddWithValue("@empMobile", empMobile);
    command.Parameters.AddWithValue("@Notes", Notes);
    command.Parameters.AddWithValue("@userName", userName);
    command.Parameters.AddWithValue("@usrPassword", usrPassword);
     command.Parameters.AddWithValue("@usrAccessLevel", usrAccessLevel);
    command.Parameters.AddWithValue("@empActive", empActive);
    command.Parameters.AddWithValue("@empMarked", empMarked);
    command.Parameters.AddWithValue("@empType", empType);
     connection.Open();
      int result = command.ExecuteNonQuery();

    // Check Error
       if(result < 0)
        Console.WriteLine("Error inserting data into Database!");
      }
  }

Answer 2

@trailmax 是对的——对于 SQL，您需要在列名列表周围加上括号，以将它们与前后的“INSERT INTO”和“VALUES”部分分开，如下所示：

INSERT INTO tblEmployees (cid, empID, empFirstName, empMidName,empLastName, empAge, empTitle, empAddress, empRank, empSalary, empEmail, empPhone,empMobile, Notes, userName, usrPassword, usrAccessLevel, empActive, empMarked, empType) VALUES (
[...]

Answer 3

我发现通过使用 string.format 为查询创建一个字符串来调试这样的代码很容易。您可以获取字符串结果并将其放入 SQL Server Management Studio (SSMS)，它具有更好的诊断功能以帮助查找问题。

            string query = string.Format("INSERT INTO tblEmployees cid, empID, empFirstName, empMidName, " +
                           "empLastName, empAge, empTitle, empAddress, empRank, empSalary, empEmail, empPhone, " +
                           "empMobile, Notes, userName, usrPassword, usrAccessLevel, empActive, empMarked, empType " +
                           "VALUES ('{0}','{1}','{2}','{3}','{4}','{5}','{6}','{7}','{8}','{9}'," +
                                   "'{10}','{11}','{12}','{13}','{14}','{15}','{16}','{17}','{18}','{19}')",
                                   this.txtID, this.txtEmpID, this.txtFirstName, this.txtMidName, this.txtLastName,
                                   this.txtEmpAge, this.txtJobTitle, this.txtAddress, this.cmbRank, this.txtSalary,
                                   this.txtEmail, this.txtPhone, this.txtMobile, this.txtNote, this.txtUserName,
                                   this.txtPassword, this.cmbAcsLevel, this.txtActive, this.txtMarked, this.txtType);