为什么我总是收到这个错误？

Question

这是我的代码

SqlConnection con = new SqlConnection(strConnection);
con.Open();

SqlCommand sqlCmd = new SqlCommand();
sqlCmd.Connection = con;
sqlCmd.CommandType = CommandType.Text;

for (int i = 0; i < dataGridView1.Rows.Count; i++)
{
    sqlCmd.CommandText = "INSERT INTO ChheckIn VALUES 
(rakmsheek,tare5sheek,esmsa7bsheek,mablgh,hesab,esmel7sab,mla7zat) (" + 
dataGridView1.Rows[i].Cells["Column1"].Value + ", " + 
dataGridView1.Rows[i].Cells["Column2"].Value + "," + 
dataGridView1.Rows[i].Cells["Column3"].Value + ", " + 
dataGridView1.Rows[i].Cells["Column4"].Value + ", " + 
dataGridView1.Rows[i].Cells["Column5"].Value + ", " + 
dataGridView1.Rows[i].Cells["Column6"].Value + ", " + 
dataGridView1.Rows[i].Cells["Column7"].Value + ",);";


    sqlCmd.ExecuteNonQuery();
    con.Close();
}

我想从我的 datagridview 获取数据到表 CheckIn。

我收到了附件截图中显示的错误。

Answer 1

问题 1：您在 INSERT INTO 语句的末尾添加了额外的逗号。
解决方案 1：：删除额外的 comma (,) at INSERT INTO 声明的结尾

注意：将所有 VARCHAR/NVARCHAR (String) 类型包含在 single quotes 中

例子：

sqlCmd.CommandText = "INSERT INTO tablename(name) VALUES('yourname');

试试这个：

sqlCmd.CommandText = "INSERT INTO ChheckIn (rakmsheek,tare5sheek,esmsa7bsheek,mablgh,hesab,esmel7sab,mla7zat) VALUES (" + dataGridView1.Rows[i].Cells["Column1"].Value + ", " + dataGridView1.Rows[i].Cells["Column2"].Value + "," + dataGridView1.Rows[i].Cells["Column3"].Value + ", " + dataGridView1.Rows[i].Cells["Column4"].Value + ", " + dataGridView1.Rows[i].Cells["Column5"].Value + ", " + dataGridView1.Rows[i].Cells["Column6"].Value + ", " + dataGridView1.Rows[i].Cells["Column7"].Value + ");";

问题 2： 您误用/组合了列名和值。

解决方案 2：您需要使用正确的语法。

 sqlCmd.CommandText = "INSERT INTO ChheckIn(rakmsheek,tare5sheek,esmsa7bsheek,mablgh,hesab,esmel7sab,mla7zat) VALUES (" + dataGridView1.Rows[i].Cells["Column1"].Value + ", " + dataGridView1.Rows[i].Cells["Column2"].Value + "," + dataGridView1.Rows[i].Cells["Column3"].Value + ", " + dataGridView1.Rows[i].Cells["Column4"].Value + ", " + dataGridView1.Rows[i].Cells["Column5"].Value + ", " + dataGridView1.Rows[i].Cells["Column6"].Value + ", " + dataGridView1.Rows[i].Cells["Column7"].Value + ");";

问题 3/建议：您的查询容易受到 SQL 注入攻击。

解决方案 3：使用Parameterised queries 来避免sql injection attacks。

sqlCmd.CommandText = "INSERT INTO ChheckIn(rakmsheek,tare5sheek,esmsa7bsheek,mablgh,hesab,esmel7sab,mla7zat)     
VALUES(@rakmsheek,@tare5sheek,@esmsa7bsheek,@mablgh,@hesab,@esmel7sab,@mla7zat)";  

sqlCmd.Parameters.AddWithValue("@rakmsheek",dataGridView1.Rows[i].Cells["Column1"].Value); 
sqlCmd.Parameters.AddWithValue("@tare5sheek",dataGridView1.Rows[i].Cells["Column2"].Value); 
sqlCmd.Parameters.AddWithValue("@esmsa7bsheek",dataGridView1.Rows[i].Cells["Column3"].Value); 
sqlCmd.Parameters.AddWithValue("@mablgh",dataGridView1.Rows[i].Cells["Column4"].Value); 
sqlCmd.Parameters.AddWithValue("@hesab",dataGridView1.Rows[i].Cells["Column5"].Value);   
sqlCmd.Parameters.AddWithValue("@esmel7sab",dataGridView1.Rows[i].Cells["Column6"].Value);
sqlCmd.Parameters.AddWithValue("@mla7zat",dataGridView1.Rows[i].Cells["Column7"].Value);