防止使用参数查询不工作的转义撇号

Question

我试图通过使用带有 SqlConnection 的参数化查询来避免在我的字符串变量中转义撇号，但它不起作用。任何帮助将不胜感激。

更新：这是当前代码...

 'Populate Connection Object
 Dim oCnn As New SqlConnection(strConnection)

 'Define our sql query
 Dim sSQL As String = "INSERT INTO [" & foreignTable & "] (data_text) VALUES (@data_text) ; "

 'Populate Command Object
  Dim oCmd As New SqlCommand(sSQL, oCnn)

  'Add up the parameter, associated it with its value

   oCmd.Parameters.AddWithValue("@data_text", data_text)

  'Opening Connection for our DB operation  
  oCnn.Open()

  Try
      Dim results As Integer = oCmd.ExecuteScalar
  Catch ex As Exception
      LabelImport.Text &= "<font color=red>ROOT Import ERROR: " & ex.ToString & ", From Database: " & dbName & ", Text String: " & data_text & "</font><br />"
      Throw
  End Try

  oCnn.Close()
  oCmd.Parameters.Clear()

感谢您的帮助。

Answer 1

是的，这是不对的。

应该是这样的：

Dim sSQL As String = "INSERT INTO [" & foreignTable & "] (data_text) VALUES (@data_text);" 

对于参数：

oCmd.Parameters.AddWithValue("@data_text", data_text) 

注意：我不“认为”您可以将表名作为参数传递。您必须在字符串中包含表名。见Parametise table name in .Net/SQL?

另外，改变这个：

Dim results As Integer = oCmd.ExecuteScalar

到

Dim results as Integer = oCmd.ExecuteNonQuery()

Answer 2

您只能在创建查询时使用表名（我的意思是从部分连接它："INSERT INTO " + foreignTable + " (data_text) VALUES...，AFAIK），而不是作为查询参数。查看SqlParameterCollection.AddWithValue on MSDN 了解更多关于SqlCommand 参数的信息，这里也有很好的例子。

'Populate Connection Object 
Dim oCnn As New SqlConnection(strConnection) 

'Define our sql query 
Dim sSQL As String = "INSERT INTO " & foreignTable & " (data_text) VALUES (@data_text);" 

'Populate Command Object 
Dim oCmd As New SqlCommand(sSQL, oCnn) 

'Add up the parameter, associated it with its value 
oCmd.Parameters.AddWithValue("@data_text", data_text) 

'Opening Connection for our DB operation   
oCnn.Open()

编辑：

+ 更改为 &，因为 C# 是“本机语言”。