在vb中参数化sql答案

【问题标题】：Parameterizing sql in vb在vb中参数化sql
【发布时间】：2015-05-08 05:46:30
【问题描述】：

我有这个模块调用过程，我想参数化它。我正在向过程模块发送一个字符串作为查询。我已经在 google 中查找，但找不到问题的答案。

Procedures.Insert("INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES ('" & txt_tech.text & "',  '" & txt_tech_email.text & "', " & cbo_tech_role.selectvalue.tostring & ")", "Technican Add Correct")

========================================== 我可能会改变它......

Procedures.Insert("INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES ('@tech_name',  '@tech_email', '@tech_role' ")", "Technican Add Correct")

================ 但是我不知道在哪里可以参数化

 Public Sub Insert(query As String, msg As String)
    Dim cn As New SqlConnection(cs)
    Dim cmd As New SqlCommand
    Try
        cn.Open()
        With cmd
            .CommandType = CommandType.Text
            .CommandText = query
            .Connection = cn
            .Parameters.AddValueWith("@tech_name",txt_tech_name.text)
            .Parameters.AddValueWith("@tech_email",txt_tech_email.text)
            .Parameters.AddValueWith("@tech_rol",txt_tech_role.selectValue.tostring)
            .ExecuteNonQuery()
        End With
        MessageBox.Show(msg, "INSERT", MessageBoxButtons.OK, MessageBoxIcon.Information)
    Catch ex As Exception
        MessageBox.Show(ex.Message.ToString, ".  :  :    ERROR    :  :  .", MessageBoxButtons.OK, MessageBoxIcon.Error)
    Finally
        If cn IsNot Nothing AndAlso cn.State <> ConnectionState.Closed Then
            cn.Close()
            cn = Nothing
        End If
    End Try
End Sub

因为我有一个与主代码分开的模块，所以我无法调用文本框，因为它们与主模块分开......关于如何做到这一点的任何想法？ ...别太难了..这是我使用 VB 的 14 周.. :/

【问题讨论】：

标签： sql vb.net parameterized

【解决方案1】：

为SqlParameters添加Insert函数参数

Public Sub Insert(query As String, msg As String, params As SqlParameter())
    Dim cn As New SqlConnection(cs)
    Dim cmd As New SqlCommand
    Try
        cn.Open()
        With cmd
            .CommandType = CommandType.Text
            .CommandText = query
            .Connection = cn
            If params IsNot Nothing AndAlso params.Count > 0 Then
                .Parameters.AddRange(params)
            End If
            .ExecuteNonQuery()
        End With
        MessageBox.Show(msg, 
                        "INSERT", 
                        MessageBoxButtons.OK, 
                        MessageBoxIcon.Information)
    Catch ex As Exception
        MessageBox.Show(ex.Message.ToString, ".  :  :    ERROR    :  :  .",
                       MessageBoxButtons.OK, 
                       MessageBoxIcon.Error)
    Finally
        If cn IsNot Nothing AndAlso cn.State <> ConnectionState.Closed Then
            cn.Close()
            cn = Nothing
        End If
    End Try
End Sub

然后像这样使用它：

Dim query As String = "INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES (@tech_name, @tech_email, @tech_role)"
Dim msg As String = "Technican Add Correct"
Dim params As SqlParameter() = {New SqlParameter("@tech_name",txt_tech_name.text),
                                New SqlParameter("@tech_email",txt_tech_email.text),
                                New SqlParameter("@tech_rol",txt_tech_role.selectValue.tostring)}

Procedures.Insert(query, msg, params)

使用SqlParameter 的数组可以让您使用具有除string 以外的参数类型的相同函数

【讨论】：

【解决方案2】：

你可以这样……它对我有用。

        String query = "INSERT INTO Technician(tec_name, tec_email, rol_id) VALUES(@tech_name, @tech_email, @tech_rolr)"
        params = {"tech_name", "tech_email", "tech_rolr"}
        values = {"" & txt_tech_name.text, "" & txt_tech_email.text, "" & txt_tech_role.selectValue.tostring()}

        SaveUpdateDelete(query, params, values)

模块下，可以放这个

    Public params() As String
    Public values() As String

    Public Sub SaveUpdateDelete(ByVal sql As String, ByVal parameters() As String, ByVal Values() As String)
      If con.State = ConnectionState.Open Then
          con.Close()
      End If
      con.Open()
      command = New MySqlCommand(sql, con)

      For i = 0 To parameters.Count - 1
          command.Parameters.AddWithValue("@" & parameters(i).ToString, Values(i))
      Next
      command.CommandText = sql
      command.ExecuteNonQuery()

      con.Close()
    End Sub

SaveUpdateDelete 方法适用于添加、更新和删除数据。您的代码只会在查询上有所不同... “插入、更新、删除”

【讨论】：