错误 MySql 您的 SQL 语法有错误。添加带有变量的参数时

Question

使用 textBox1.Text 添加参数时出现语法错误。我想向数据库添加一列。我该怎么做才对。请写出正确的代码

private async void button1_Click(object sender, EventArgs e)
{      
    MySqlCommand command = new MySqlCommand("ALTER TABLE Students ADD COLUMN ? TEXT", sqlConnection);

    command.Parameters.AddWithValue("?", textBox1.Text); 

    try
    {
        await command.ExecuteNonQueryAsync();
        Close();

    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message, "Ошибка!", MessageBoxButtons.OK, MessageBoxIcon.Error);
    }

}

截图https://i.paste.pics/77ce28a6fd93598b0939bc43a1d15b9a.png

截图2结果回答https://i.paste.pics/a9e8c0739bcbaf6cf7a23ca62a9c9812.png

Answer 1

参数不能用于修改列名或表名。您必须手动构建查询。但不要忘记转义用户输入，以避免 sql 注入：

string escapedStringColumnName = MySql.Data.MySqlClient.MySqlHelper.EscapeString(textBox1.Text);

// Do some more validations, what text you got before building you column..
if (!new Regex("[a-zA-z ]+").IsMatch(escapedStringColumnName))
    throw new Exception();

MySqlCommand command = new MySqlCommand("ALTER TABLE Students ADD COLUMN `" + escapedStringColumnName + "` TEXT", sqlConnection);