如何防止使用 If Else 语句将某些数据插入数据库？

Question

我有两个组合框，一个消息框和一个发送按钮。当应用程序启动时，我在组合框和消息框为空的情况下单击发送按钮，弹出一个框并显示"Select a client" 执行此操作后，我返回数据库并看到它已将新记录添加到那个表，即使我在点击“发送”按钮后没有输入任何数据。同样适用于当我拥有的三个控件之一有数据但其他两个没有，并且程序要求我在成功之前输入该数据时。但是，尽管有这些 If 语句，它仍然会添加记录。我究竟做错了什么？

我的代码：

Using con As New SqlConnection(ConfigurationManager.ConnectionStrings("conStr").ConnectionString)

    con.Open()

    Using cmd As New SqlCommand
        cmd.Connection = con
        cmd.CommandText = "insert into tblMyTable(Client, UserName, Message) values('" & cboClient.Text & "', '" & cboUser.Text & "', '" & rtfMessage.Text & "')"
        cmd.ExecuteNonQuery()
    End Using
    If cboClient.Text = "" Then
        MsgBox("Select a client")
    ElseIf cboUser.Text = "" Then
        MsgBox("Select a user")
    ElseIf rtfMessage.Text = "" Then
        MsgBox("Enter a message")
    Else
        MsgBox("Message Sent")
    End If
    con.Close()

End Using

Answer 1

我认为你想要这样的东西（注意这不解决参数化问题）：

Using con As New SqlConnection(ConfigurationManager.ConnectionStrings("conStr").ConnectionString)


    If cboClient.Text = "" Then
        MsgBox("Select a client")
    ElseIf cboUser.Text = "" Then
        MsgBox("Select a user")
    ElseIf rtfMessage.Text = "" Then
        MsgBox("Enter a message")
    Else
        con.Open()
        Using cmd As New SqlCommand
          cmd.Connection = con
          cmd.CommandText = "insert into tblMyTable(Client, UserName, Message) values('" & cboClient.Text & "', '" & cboUser.Text & "', '" & rtfMessage.Text & "')"
          cmd.ExecuteNonQuery()
        End Using

        MsgBox("Message Sent")
    End If
    con.Close()

End Using

Answer 2

@OldProgrammer 的类似解决方案，尝试参数化插入。

    Private Sub SendButton_Click(sender As System.Object, e As System.EventArgs) Handles SendButton.Click
        Try
            If writeMessage() Then
                MessageBox.Show("Message sent.", "Success")
            End If
        Catch ex As Exception
            MessageBox.Show(String.Concat("An error occurred sending this message:", ex.Message))
        End Try
    End Sub    

    Private Function writeMessage() As Boolean

        If isValidMessage() Then
            writeMessageInfo()
            Return True
        End If

        Return False

    End Function

    Private Sub writeMessageInfo()

        Using con As New SqlConnection(yourConnectionString)

            con.Open()

            Using cmd As New SqlCommand
                cmd.Connection = con
                cmd.Parameters.Add(New SqlParameter("clientValue", cboClient.Text))
                cmd.Parameters.Add(New SqlParameter("userValue", cboUser.Text))
                cmd.Parameters.Add(New SqlParameter("messageText", rtfMessage.Text))
                cmd.CommandText = "insert into tblMyTable(Client, UserName, Message) values(@clientValuem, @userValue, @messageText)"
                cmd.ExecuteNonQuery()
            End Using

            con.Close()

        End Using
    End Sub


    Private Function isValidMessage() As Boolean

        If cboClient.SelectedIndex = -1 Then
            MessageBox.Show("Please select a client.", "Missing info")
            cboClient.Focus()
            Return False
        End If

        If cboUser.SelectedIndex = -1 Then
            MessageBox.Show("Please select a user.", "Missing info")
            cboUser.Focus()
            Return False
        End If

        If rtfMessage.Text = String.Empty Then
            MessageBox.Show("Please enter a message.", "Missing info")
            rtfMessage.Focus()
            Return False
        End If

        Return True

    End Function