错误：“列名无效”，但已创建列

Question

我创建了一个 Web 项目，但是当我尝试将值插入本地数据库时，我收到以下错误：

错误：列名“22 478 295 290”无效。列名“Oreki”无效。列名“Redgrave”无效。列名“女性”无效。列名“Sample@gmail.com”无效。列名“1234”无效。列名 ''12, 1 2017'' 无效。列名“18:41:44:529”无效。

这是我的 SQL 表：

CREATE TABLE [dbo].[Account] (
[ID]           VARCHAR(50)          NOT NULL,
[Firstname]    VARCHAR (MAX)   NOT NULL,
[Lastname]     VARCHAR(50) NOT NULL,
[Gender]       VARCHAR (10)    NOT NULL,
[Email]        VARCHAR(50)            NOT NULL,
[Password]     VARCHAR(50)            NOT NULL,
[DateRegister] VARCHAR (50)    NOT NULL,
[TimeRegister] VARCHAR (25)    NOT NULL, 
CONSTRAINT [PK_Account] PRIMARY KEY ([ID])

);

这是我的 ASP.Net C# 代码：

    try
    {
        SqlConnection Connect = new SqlConnection("Data Source=(LocalDB)\\MSSQLLocalDB;AttachDbFilename=C:\\Users\\Oreki Illustration\\Documents\\NowTips.mdf;Integrated Security=True;Connect Timeout=30");
        SqlCommand Say = new SqlCommand();
        DateTime Date = DateTime.Now;

        string GetStringDate = Date.Month.ToString() + ", " + Date.Day.ToString() + " " + Date.Year.ToString();
        string GetStringTime = Date.Hour.ToString() + ":" + Date.Minute.ToString() + ":" + Date.Second.ToString() + ":" + Date.Millisecond.ToString();

        Connect.Open();
        Say.Connection = Connect;
        Say.CommandText = "Insert into Account values (['" + GetID + "'], ['" + Firstname.Text + "'], ['" + Lastname.Text + "'], ['" + Gender.SelectedValue.ToString() + "'], ['" + Email.Text + "'], ['" + RePassword.Text + "'], ['" + GetStringDate + "'], ['" + GetStringTime + "'])";
        Say.ExecuteNonQuery();
        Connect.Close();

    }
    catch (Exception Message)
    {
        form1.InnerHtml = "Error : " + Message.Message;
    }


public string GetID
{
    get
    {
        string A = "", B = "", C = "", D = "";

        Random RandomID = new Random();

        for (int x = 0; x < 10; x++) A = RandomID.Next(1000).ToString();
        for (int x = 0; x < 10; x++) B = RandomID.Next(1000).ToString();
        for (int x = 0; x < 10; x++) C = RandomID.Next(1000).ToString();
        for (int x = 0; x < 10; x++) D = RandomID.Next(1000).ToString();

        return A + " " + B + " " + C + " " + D;
    }
}

我该如何解决这个错误？

Answer 1

使用参数修改您的代码，如下所示，

 cmd.CommandText = "Insert into Account values
                ([@GetID, @Firstname, @Lastname, @Gender, @Email, @RePassword, @GetStringDate, @GetStringTime)";
 cmd.Parameters.AddWithValue("@GetID", GetID);
 cmd.Parameters.AddWithValue("@Firstname", Firstname.Text);
 cmd.Parameters.AddWithValue("@Lastname", Lastname.Text);
 cmd.Parameters.AddWithValue("@Gender", Gender.SelectedValue.ToString());
 cmd.Parameters.AddWithValue("@Email", Email.Text);
 cmd.Parameters.AddWithValue("@RePassword", RePassword.Text);
 cmd.Parameters.AddWithValue("@GetStringDate", GetStringDate);
 cmd.Parameters.AddWithValue("@GetStringTime", GetStringTime);

---

你做事的方式不对，

1. 这样传递参数会导致sql注入
2. 为了避免它使用Sql参数
3. 使用using进行连接，所以会自动处理

下面是你怎么做的例子，这里的重点是使用参数而不是像你现在做的普通查询

string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
        + "WHERE CustomerID = @ID;";

    using (SqlConnection connection = new SqlConnection(connectionString))
    {
        SqlCommand command = new SqlCommand(commandText, connection);
        command.Parameters.Add("@ID", SqlDbType.Int);
        command.Parameters["@ID"].Value = customerID;

        // Use AddWithValue to assign Demographics.
        // SQL Server will implicitly convert strings into XML.
        command.Parameters.AddWithValue("@demographics", demoXml);

        try
        {
            connection.Open();
            Int32 rowsAffected = command.ExecuteNonQuery();
            Console.WriteLine("RowsAffected: {0}", rowsAffected);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }