【发布时间】:2011-05-09 01:01:10
【问题描述】:
我正在构建一个用于训练的练习项目,但我的处理程序禁止我进行参数化,我宁愿现在专注于其他事情。他指示我使用以下类型的字符串插入。我知道这不安全。它不适用于实际部署。然而,我陷入了困境,因为在对数据库进行了一些必要的重组之后,我需要重新编写插入和选择命令。我的 Submission 表有一个自动递增的 SubmissionId 列,我需要将该值插入到我的 Broker 和 Customer 表的 SubId 列中。我该怎么做呢?
string idQuery = "SELECT SCOPE_IDENTITY() AS LastInsertedSubmissionId";
String custQuery = "INSERT INTO Customer
(CustId, CustName, SicNaic, CustAdd, CustCity, CustState, CustZip, SubId)
VALUES
('" + TbCustId.Text + "', '" + TbCustName.Text + "', '" + RblSicNaic.SelectedItem + "', '" + TbCustAddress.Text + "', '" + TbCustCity.Text + "', '" + DdlCustState.SelectedItem + "', '" + TbCustZip.Text + "', *whatgoeshere?*)";
String broQuery = "INSERT INTO Broker
(BroId, BroName, BroAdd, BroCity, BroState, BroZip, EntityType, SubId)
VALUES
('" + TbBroId.Text + "', '" + TbBroName.Text + "', '" + TbBroAddress.Text + "', '" + TbBroCity.Text + "', '" + DdlBroState.SelectedItem + "', '" + TbBroZip.Text + "', '" + DdlEntity.SelectedItem + "', *whatgoeshere?*)";
String subQuery = "INSERT INTO Submission
(Coverage, CurrentCoverage, PrimEx, Retention, EffectiveDate, Commission, Premium, Comments)
VALUES
('" + TbCoverage.Text + "','" + TbCurrentCoverage.Text + "','" + TbPrimEx.Text + "','" + TbRetention.Text + "','" + TbEffectiveDate.Text + "','" + TbCommission.Text + "','" + TbPremium.Text + "','" + TbComments.Text + "')";
【问题讨论】:
标签: c# asp.net sql-server visual-studio