尝试使用 asp.net 和 c# 将数据插入数据库

Question

当单击我的 asp.net 页面上的按钮时，我试图将数据插入表中。我没有收到任何错误，但是当我在插入信息后尝试将用户重定向到新页面时，它会停留在同一页面上。下面是我的代码。

SqlConnection db = new SqlConnection();
    db.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["AboutYouEntities"].ConnectionString;
    db.Open();


    SqlCommand insertUser = new SqlCommand();
    SqlCommand insertContact = new SqlCommand();

    insertUser.CommandText = "INSERT into USER (Email, Name, Gender, BirthDate, LinuxDistro) VALUES ('" + userInfo.Email + "','" + userInfo.Name + "','" + userInfo.Gender + "','" + userInfo.BirthDate + "','" + userInfo.LinuxDistro + "')";


    insertContact.CommandText = "INSERT into CONTACT (Phone, Zip, Comments) VALUES ('" + userContact.Phone + "','" + userContact.Zip + "','" + userContact.Comments + "')";

    insertUser.ExecuteNonQuery();
    insertContact.ExecuteNonQuery();

    db.Close();

    Response.Redirect("ThankYou.aspx");

Answer 1

您的代码有一些问题：

• 您的命令没有附加连接。
• USER 是reserve word，应该用方括号括起来，例如[USER]
• 你应该parametrized你的查询，你倾向于SQL Injection。
• 考虑在using 语句中包含SqlConnection 和SqlCommand 对象，因为这将确保资源的处置。

代码：

using (SqlConnection db = new SqlConnection())
{
    db.ConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["AboutYouEntities"].ConnectionString;
    db.Open();
    using (SqlCommand insertUser = new SqlCommand())
    {
        insertUser.Connection = db;
        insertUser.CommandText = "INSERT into [USER] (Email, Name, Gender, BirthDate, LinuxDistro) VALUES (@Email, @Name, @Gender,@BirthDate, @LinuxDistro);";
        insertUser.Parameters.AddWithValue("@Email", userInfo.Email);
        insertUser.Parameters.AddWithValue("@Name", userInfo.Name);
        insertUser.Parameters.AddWithValue("@Gender", userInfo.Gender);
        insertUser.Parameters.AddWithValue("@BirthDate", userInfo.BirthDate);
        insertUser.Parameters.AddWithValue("@LinuxDistro", userInfo.LinuxDistro);
        insertUser.ExecuteNonQuery();
    }
    using (SqlCommand insertContact = new SqlCommand())
    {
        insertContact.Connection = db;
        insertContact.CommandText = "INSERT into CONTACT (Phone, Zip, Comments) VALUES (@Phone, @Zip, @Comments);";
        insertContact.Parameters.AddWithValue("@Phone", userContact.Phone);
        insertContact.Parameters.AddWithValue("@Zip", userContact.Zip);
        insertContact.Parameters.AddWithValue("@Comments", userContact.Comments);
        insertContact.ExecuteNonQuery();
    }
}