System.Data.SqlClient.SqlException：'关键字'值'附近的语法不正确。'

Question

namespace login_page
{
    public partial class itemselect : Form
    {
        public itemselect()
        {
            InitializeComponent();
        }

        private void product_Click(object sender, EventArgs e)
        {

        }

        private void Addproduct_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection("Data Source=DESKTOP-QI8RJIB;Initial Catalog=itemselect;Integrated Security=True");
            con.Open();
            SqlCommand cmd = new SqlCommand(" insert into itemselect([Product ID],[Product Name],[Product Quantity],[Product Price] values ('" +pid.Text+ "','" +pn.Text+ "','" +pq.Text+ "','" +pp.Text+ "')", con);
            cmd.CommandType = CommandType.Text;
            cmd.ExecuteNonQuery();
            this.Close();
            MessageBox.Show("item added successfully");

        }

例外：

System.Data.SqlClient.SqlException: '关键字附近的语法不正确 '价值观'。'

Answer 1

你在values这个词之前缺少了一个结束语。

• 您还应该使用using 语句来确保连接 执行后将关闭
• 您还应该使用Parameters.AddWithValue() 方法来避免 SQL INJECTION

Answer 2

您的语法不正确，请确保您已关闭所有打开的括号。

另外，请始终使用SqlParameters 来防止Sql injection 攻击并提高代码可读性

示例代码

private void Addproduct_Click(object sender, EventArgs e)
{
    string query = "INSERT INTO itemselect ([Product ID],[Product Name],[Product Quantity],[Product Price]) VALUES (@ProductID, @ProductName, @ProductQuantity, @ProductPrice)";
    using (var con = new SqlConnection(@"Data Source=DESKTOP-QI8RJIB;Initial Catalog=itemselect;Integrated Security=True"))
    using (var cmd = new SqlCommand(query, con))
    {
        // Not sure about ProductID type. Could be SqlDbType.UniqueIdentifier or SqlDbType.Int / BigInt
        cmd.Parameters.Add(new SqlParameter("@ProductID", SqlDbType.UniqueIdentifier)).Value = pid.Text;
        cmd.Parameters.Add(new SqlParameter("@ProductName", SqlDbType.NVarChar)).Value = pp.Text;
        cmd.Parameters.Add(new SqlParameter("@ProductQuantity", SqlDbType.Int)).Value = pq.Text;
        cmd.Parameters.Add(new SqlParameter("@ProductPrice", SqlDbType.Decimal)).Value = pp.Text;
        try
        {
            con.Open();
            cmd.ExecuteNonQuery();
            // Records Inserted Successfully
        }
        catch (SqlException err)
        {
            // Error occured. Handle error
        }
    }
}

P.S：在命名表、列和变量时请遵循命名约定