在插入语句中使用选择范围值？

Question

注意：我正在构建一个练习项目，我的培训师禁止我进行参数化。我知道安全风险，但不会部署该站点。我正在使用 select scope_identity 方法从我的表 Submissions 的 SubmissionId 列中获取一个自动递增的值。

我想将该值插入到另外两个表中；我已将 newSubID 声明为 var，并在插入语句中使用它，但收到错误消息

在此上下文中不允许使用名称“newSubID”。有效表达式是常量、常量表达式和（在某些情况下）变量。不允许使用列名。

我在这里错过了什么？

这是我的代码：

protected void BtnSubmit_Click(object sender, EventArgs e)
{
    string connectionString = System.Configuration.ConfigurationManager.ConnectionStrings["MyConnectionString"].ConnectionString;
    String subQuery = "INSERT INTO Submission (Coverage, CurrentCoverage, PrimEx, Retention, EffectiveDate, Commission, Premium, Comments) VALUES ('" + TbCoverage.Text + "','" + TbCurrentCoverage.Text + "','" + TbPrimEx.Text + "','" + TbRetention.Text + "','" + TbEffectiveDate.Text + "','" + TbCommission.Text + "','" + TbPremium.Text + "','" + TbComments.Text + "')"
        + "SELECT CAST (SCOPE_IDENTITY() AS int)";

    using (SqlConnection sqlConn = new SqlConnection(connectionString))
    {
        sqlConn.Open();
        SqlCommand subCmd = new SqlCommand(subQuery, sqlConn);

        using (subCmd)
        {
            subCmd.ExecuteNonQuery();
            var newSubID = (Int32)subCmd.ExecuteScalar();

            String custQuery = "INSERT INTO Customer (CustId, CustName, SicNaic, CustAdd, CustCity, CustState, CustZip, SubId) VALUES ('" + TbCustId.Text + "', '" + TbCustName.Text + "', '" + RblSicNaic.SelectedItem + "', '" + TbCustAddress.Text + "', '" + TbCustCity.Text + "', '" + DdlCustState.SelectedItem + "', '" + TbCustZip.Text + "', newSubID)";
            String broQuery = "INSERT INTO Broker (BroId, BroName, BroAdd, BroCity, BroState, BroZip, EntityType, SubId) VALUES ('" + TbBroId.Text + "', '" + TbBroName.Text + "', '" + TbBroAddress.Text + "', '" + TbBroCity.Text + "', '" + DdlBroState.SelectedItem + "', '" + TbBroZip.Text + "', '" + DdlEntity.SelectedItem + "', newSubID)";
            SqlCommand custCmd = new SqlCommand(custQuery, sqlConn);
            SqlCommand broCmd = new SqlCommand(broQuery, sqlConn);
            using (custCmd)
            using (broCmd)
            {
                custCmd.ExecuteNonQuery();
                broCmd.ExecuteNonQuery();
                Response.Redirect("~/View.aspx?ProductId=" + newSubID);
            }

这是在下一页上调用的（我留下了错误，因为它们是为了帮助任何可能需要查看问题和解决方案的人，这些问题和解决方案列在下面的答案中）：

string x = Request.QueryString["SubmissionId"];
string connectionString = System.Configuration.ConfigurationManager.ConnectionStrings["MyConnectionString"].ConnectionString;
string editCustQuery = "SELECT CustName, SicNaic, CustCity, CustAdd, CustState, CustZip FROM Customer WHERE SubId =" + x;
using (SqlConnection editConn = new SqlConnection(connectionString))
{
    editConn.Open();

    using (SqlCommand CustCommand = new SqlCommand(editCustQuery, editConn))
    {
        SqlDataReader dr = CustCommand.ExecuteReader();
        dr.Read();
        LblCustName.Text = dr.GetString(0);
        LblSicNaic.Text = dr.GetString(1);
        LblCustCity.Text = dr.GetString(2);
        LblCustAddress.Text = dr.GetString(3);
        LblCustState.Text = dr.GetString(4);
        LblCustZip.Text = dr.GetInt32(5).ToString();
    }

Answer 1

这是因为您没有将 newSubID 连接到 custQuery / btoQuery SQL 语句中，而是在语句中使用文字文本“newSubID”，这在此处无效，因为它将假定“newSubID”是列名。

即

String custQuery = "INSERT INTO Customer (CustId, CustName, SicNaic, CustAdd, CustCity,
    CustState, CustZip, SubId) 
VALUES ('" + TbCustId.Text + "', '" + TbCustName.Text + "', '" + RblSicNaic.SelectedItem +   
    "', '" + TbCustAddress.Text + "', '" + TbCustCity.Text + "', '" + 
    DdlCustState.SelectedItem + "', '" + TbCustZip.Text + "'," + 
    newSubID.toString() + ")";

当然，由于您的免责声明，我只给出一个使用动态 SQL 的答案，而不是我在现实生活中会做的事情！

Answer 2

1. AdaTheDev 的答案是正确的。

2. 我认为您还有另一个问题。如果您使用相同的命令执行 ExecuteNonQuery 和 ExecuteScalar，您将插入两次。为您的 scope_id 使用 out-parameter 并仅调用 exenonquery 或仅调用 exescalar。

           //subCmd.ExecuteNonQuery();
           var newSubID = (Int32)subCmd.ExecuteScalar();