sql缺少逗号

Question

protected void ImageButton2_Click(object sender, ImageClickEventArgs e)
{
    string loginID = (String)Session["UserID"];
    string ID = txtID.Text;
    string password = txtPassword.Text;
    string name = txtName.Text;
    string position = txtPosition.Text;
    int status = 1;
    string createOn = validate.GetTimestamp(DateTime.Now); ;
    string accessRight;

    if (RadioButton1.Checked)
        accessRight = "Administrator";
    else
        accessRight = "Non-administrator";

    if (txtID.Text != "")
        ClientScript.RegisterStartupScript(this.GetType(), "yourMessage", "alert('" + ID + "ha " + password + "ha " + status + "ha " + accessRight + "ha " + position + "ha " + name + "ha " + createOn + "');", true);

    string sqlcommand = "INSERT INTO USERMASTER (USERID,USERPWD,USERNAME,USERPOISITION,USERACCESSRIGHTS,USERSTATUS,CREATEDATE,CREATEUSERID) VALUES ("+ ID + "," + password + "," + name + "," + position + "," + accessRight + "," + status + "," + createOn + "," +loginID+ ")";
    readdata.updateData(sqlcommand);
}

我将 sqlcommand 传递给 readdata 类以执行..它向我抛出了这个错误..

ORA-00917：缺少逗号

描述：执行过程中发生了未处理的异常 当前的网络请求。请查看堆栈跟踪以获取更多信息 有关错误的信息以及它在代码中的来源。

异常详细信息：System.Data.OleDb.OleDbException：ORA-00917： 缺少逗号。

readdata类函数代码如下。

public void updateData(string SqlCommand)
{
    string strConString = ConfigurationManager.ConnectionStrings["SOConnectionString"].ConnectionString;
    OleDbConnection conn = new OleDbConnection(strConString);
    OleDbCommand cmd = new OleDbCommand(SqlCommand, conn);
    OleDbDataAdapter daPerson = new OleDbDataAdapter(cmd);

    conn.Open();
    cmd.ExecuteNonQuery();
}

Answer 1

鉴于您的大多数列都是可变长度字符，它们必须用单引号引起来。 所以，而不是：

string sqlcommand = "INSERT INTO myTable (ColumnName) VALUES (" + InputValue + ")";

你至少需要这个：

string sqlcommand = "INSERT INTO myTable (ColumnName) VALUES ('" + InputValue + "')";

对于“foo”的 InputValue，第一条语句的结果将是：

INSERT INTO myTable (ColumnName) VALUES (foo)

这会导致语法错误。

第二条语句的格式正确，如：

INSERT INTO myTable (ColumnName) VALUES ('foo')

此外，此代码似乎使用用户直接输入的值，输入到 txtID、txtPassword 等。这是一个 SQL 注入攻击向量。您的输入需要转义。理想情况下，您应该在此处使用参数化查询。

这似乎是 c#。请相应地更新您的标签。 无论如何，如果它是 .Net，这里有一些关于参数化查询的更多信息：

OleDbCommand.Parameters Property

OleDbParameter Class

Answer 2

试试这个

string sqlcommand = "INSERT INTO USERMASTER (USERID,USERPWD,USERNAME,USERPOISITION,USERACCESSRIGHTS,USERSTATUS,CREATEDATE,CREATEUSERID) VALUES ('"+ ID + "','" + password + "','" + name + "','" + position + "','" + accessRight + "','" + status + "','" + createOn + "','" +loginID+ "')";

Answer 3

不推荐连接查询并执行它，因为它可能会导致强 SQl 注入。假设如果这些参数中的任何一个包含逗号（，），例如USERPWD=passwo',rd，那么查询会将其划分为passwo 和rd 的逗号。这可能是个问题

建议您使用“Parameterized queries to prevent SQL Injection Attacks in SQL Server”，希望它能解决您的问题。

你的代码可以改写如下

protected void ImageButton2_Click(object sender, ImageClickEventArgs e)
{
    string loginID = (String)Session["UserID"];
    string ID = txtID.Text;
    string password = txtPassword.Text;
    string name = txtName.Text;
    string position = txtPosition.Text;
    int status = 1;
    string createOn = validate.GetTimestamp(DateTime.Now); ;
    string accessRight;

    if (RadioButton1.Checked)
        accessRight = "Administrator";
    else
        accessRight = "Non-administrator";

    if (txtID.Text != "")
        ClientScript.RegisterStartupScript(this.GetType(), "yourMessage", "alert('" + ID + "ha " + password + "ha " + status + "ha " + accessRight + "ha " + position + "ha " + name + "ha " + createOn + "');", true);

    string strQuery;
    OleDbCommand  cmd;
    strQuery = "INSERT INTO USERMASTER(USERID,USERPWD,USERNAME,USERPOISITION,USERACCESSRIGHTS,USERSTATUS,CREATEDATE,CREATEUSERID) VALUES(@ID,@password,@name,@position,@accessRight,@status,@createOn,@loginID)";

    cmd = new OleDbCommand(strQuery);
    cmd.Parameters.AddWithValue("@ID", ID);
    cmd.Parameters.AddWithValue("@password", password);
    cmd.Parameters.AddWithValue("@name", name);
    cmd.Parameters.AddWithValue("@position", position);
    cmd.Parameters.AddWithValue("@accessRight", accessRight);
    cmd.Parameters.AddWithValue("@status", status);
    cmd.Parameters.AddWithValue("@createOn", createOn);
    cmd.Parameters.AddWithValue("@loginID", loginID);

    bool isInserted =  readdata.updateData(cmd);
}

如下重写你的 updateData 数据

private Boolean updateData(OleDbCommand cmd)
{
    string strConString = ConfigurationManager.ConnectionStrings["SOConnectionString"].ConnectionString;
    OleDbConnection conn = new OleDbConnection(strConString);
    cmd.CommandType = CommandType.Text;
    cmd.Connection = con;
    try
    {
        con.Open();
        cmd.ExecuteNonQuery();
        return true;
    }
    catch (Exception ex)
    {
        Response.Write(ex.Message);
        return false;
    }
    finally
    {
        con.Close();
        con.Dispose();
    }
}