我无法在我的访问数据库中插入值

Question

这是我在 VB.NET 中的代码。

我的 try catch 说指令 INSERT INTO 中存在语法错误。我不知道我的 INSERT 发生了什么。我搜索了一个多小时的错误...我不是 VB.NET 方面的专家，我在 C# 方面做得更好，但无论如何我都需要在 VB 中这样做...

谢谢你帮助我！！

Sub InsertRecord()
Dim conClasf As OleDbConnection
Dim cmdClasf As New OleDbCommand
Dim strClasf As String
Dim strSQL As String
Dim intRowsAff As Integer

 lblErrMsg.Text = ""
 lblRecsAff.Text = ""
  strClasf = "Provider=Microsoft.Jet.OLEDB.4.0;" & _
         "Data Source=" & _
         server.mappath("BecsEtMuseaux.mdb") & ";"
 conClasf = New OleDbConnection(strClasf)
 conClasf.Open

Randomize
    strSQL = "INSERT INTO client (" & _
        "UserName, " & _
        "Prenom, " & _
        "Nom, " & _
        "password, " & _
        "mail, " & _
        "Addresse, " & _
        "Ville, " & _
        "PostalCode, " & _
        "Province, " & _
        "Pays, " & _
        "AnimalGenre, " & _
        "NomAnimal, " & _
        "Race, " & _
") VALUES ('" & _
        Replace(txtUserName.Text, "'", "''") & _
        "', '" & _
        Replace(txtPrénom.Text, "'", "''") & _
        "', '" & _
        Replace(txtNom.Text, "'", "''") & _
        "', '" & _
        Replace(txtPass.Text, "'", "''") & _
        "', '" & _
        Replace(txtMail.Text, "'", "''") & _
        "', " & _
        Replace(txtAdresse.Text, "'", "''") & _
        "', " & _
         Replace(txtVille.Text, "'", "''") & _
        "', " & _
        Replace(txtPostal.Text, "'", "''") & _
        "', " & _
         Replace(txtProvince.Text, "'", "''") & _
        "', " & _
         Replace(txtPays.Text, "'", "''") & _
        "', " & _
         Replace(rblAnimal.Text, "'", "''") & _
        "', " & _
        Replace(txtAnimal.Text, "'", "''") & _
        "', " & _
         Replace(txtRace.Text, "'", "''")

      cmdClasf = New OleDbCommand(strSQL, conClasf)
      Try
      intRowsAff = cmdClasf.ExecuteNonQuery()
      Catch ex As Exception
      lblErrMsg.Text = ex.Message    
      End Try
      lblRecsAff.Text = intRowsAff & " record(s) inserted"
      conClasf.Close
 End Sub

Answer 1

转义密码字段。为Access Engine.的保留字。

strSQL = "INSERT INTO client (UserName,Prenom,Nom,[password],mail,
          Addresse,Ville,PostalCode,Province,Pays,AnimalGenre,NomAnimal,Race)
          VALUES 
          (@UserName,@Prenom,@Nom,@password,@mail,
            @Addresse,@Ville,@PostalCode,@Province,@Pays,
             @AnimalGenre,@NomAnimal,@Race)"

Answer 2

也许这会导致您出错。

       "Race, " & _ //Race**,** try to remove ,
")

如果你试试这个会更好：

你可以使用Parameters来避免sqlinjection。

  strSQL = "INSERT INTO client (UserName,Prenom,Nom,password,mail,Addresse,Ville,PostalCode,Province,Pays,AnimalGenre,NomAnimal,Race) VALUES (@UserName,@Prenom,@Nom,@password,@mail,@Addresse,@Ville,@PostalCode,@Province,@Pays,@AnimalGenre,@NomAnimal,@Race)"

  cmdClasf.Parameters.Add("@UserName", OleDbType.VarChar, 50).Value = txtUserName.Text
 //DO OTHER STUFF UNITL @Race

另见：

Parameter Queries in ASP.NET with MS Access

Configuring Parameters and Parameter Data Types (ADO.NET)

Use Parameters in your sql command

希望对您有所帮助。

问候