【发布时间】:2015-09-16 17:15:31
【问题描述】:
我的 aspx.cs 页面中有这段代码。在我的数据库中,我有列 Username、Firstname、Lastname、Email、Password、CustomerType、DeliveryAddress、Zipcode 和 Contact number。
我想要做的是用户名和客户类型保持不可编辑,其他可以由用户编辑。
aspx.cs
protected void fvClientProfile_ItemUpdating(object sender, FormViewUpdateEventArgs e)
{
DataKey key = fvClientProfile.DataKey;
TextBox txtFN = (TextBox)fvClientProfile.FindControl("txtFN");
TextBox txtLN = (TextBox)fvClientProfile.FindControl("txtLN");
TextBox txtAddress = (TextBox)fvClientProfile.FindControl("txtAddress");
TextBox txtEmail = (TextBox)fvClientProfile.FindControl("txtEmail");
TextBox txtContact = (TextBox)fvClientProfile.FindControl("txtContact");
SqlConnection conn = new SqlConnection("Data Source = 'PAULO'; Initial Catalog=ShoppingCartDB;Integrated Security =True");
SqlDataAdapter da = new SqlDataAdapter("", conn);
conn.Open();
da.UpdateCommand = new SqlCommand( "UPDATE UserData SET FirstName ='" + txtFN.Text + "',LastName ='" + txtLN.Text + "',Address ='" + txtAddress.Text + "',Email ='" + txtEmail.Text + "',Contact='"+ txtContact.Text+"' WHERE ID='" + key.Value.ToString() + "'");
da.UpdateCommand.ExecuteNonQuery();
Response.Write("Record updated successfully");
bindgrid();
conn.Close();
}
protected void fvClientProfile_ModeChanging(object sender, FormViewModeEventArgs e)
{
fvClientProfile.ChangeMode(e.NewMode);
bindgrid();
if (e.NewMode == FormViewMode.Edit)
{
fvClientProfile.AllowPaging = false;
}
else
{
fvClientProfile.AllowPaging = true;
}
}
【问题讨论】:
-
SQL Injection alert - 您应该不将您的 SQL 语句连接在一起 - 使用 参数化查询 来避免 SQL 注入