更新查询在 vb.net 中不起作用

Question

我想在 vb.net 后面的代码中编写更新语句。如果 tbl_ICCID 中存在 ICCID，则将状态从 0 更改为 1 并且 Pic_Correct_ICCID.visible=true，如果不存在，则显示“未找到”。 我写了这段代码，但没有工作，对于 Tbl_ICCID Pic_Correct_ICCID.visible=true 中不存在的所有 ICCID。 请检查我的代码并解决我的问题。

in Cls_ICCID:

 Public Function Update_Status(ByVal ICCID_No As String, ByVal status As Integer) As String
        Try
            Dim cmd As SqlCommand
            Dim sql As String
            Dim sql2 As String
            Dim myConnection As SqlConnection = New SqlConnection()
            myConnection.ConnectionString = "Data Source=TEHRANI\TEHRANI;Initial Catalog=GSMProduction;Persist Security Info=True;User ID=sa;Password=1"
            **sql = "UPDATE Tbl_ICCID SET Status='" & status & "' Where ( ICCID = '" & ICCID_No & "' )"**
            myConnection.Open()
            cmd = New SqlCommand(sql, myConnection)
            cmd.ExecuteNonQuery()
            cmd.Dispose()
            myConnection.Close()
            Update_Status = ""
        Catch ex As SqlException
            Update_Status = "Not found"
        Catch ex As Exception
            Update_Status = "Not connect to server"
        End Try
    End Function

in Frm_Packing



Private Sub Txt_ICCID_TextChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Txt_ICCID.TextChanged

        Pic_BP_Correct.Visible = False
        Pic_BP_Wrong.Visible = False

        Try
            If Txt_ICCID.Text.Length = Txt_ICCID.MaxLength Then
                lblError.Text = clsICCID.Update_Status(Txt_ICCID.Text.ToString(), 1)
                lblError.ForeColor = Color.Red
                stream = New System.IO.MemoryStream
                pic_barcode = Nothing
                cls.btnEncode(pic_barcode, Txt_ICCID.Text.Trim)
                pic_barcode.Save(stream, System.Drawing.Imaging.ImageFormat.Png)
                f = New IO.FileStream("C:\test55.png", IO.FileMode.Create, IO.FileAccess.ReadWrite)
                b = stream.ToArray
                f.Write(b, 0, b.Length)
                f.Close()
                Dim Val() = {stream.ToArray, Txt_ICCID.Text.Trim}
                ds.Tables(0).Rows.Add(Val)
                crp_report.SetDataSource(ds.Tables(0))
                frm_crp.CrystalReportViewer1.ReportSource = crp_report
                If lblError.Text = "" Then
                    Pic_BP_Correct.Visible = True
                    GBDoubleCheck.Visible = True
                    Txt_LabelBarcode.Focus()
                Else
                    Pic_BP_Wrong.Visible = True
                End If
            End If
        Catch ex As Exception
            Pic_BP_Wrong.Visible = True
        End Try
    End Sub

Answer 1

很可能是由于将状态列值作为字符串而不是 int 发送。您应该删除那些单引号。此外，这样连接查询确实是非常糟糕的做法。使用 CommandBuilders 之类的东西或 Typed DataSets 来避免 SQL 注入。