字符串 ')' 后 '' 未闭合引号附近的语法不正确

Question

我在 Visual Web Dev 2010 Express 中使用 C# 创建了一个 Web 表单，它包含文本框/标签（基于复选框）但是当我运行代码在运行宁 SQL 命令。在仅使用 3 个文本框之前我已经让代码可以工作，但是当我展开代码时似乎不起作用。

我尝试过的事情：

当谷歌搜索时有人说引号是一个问题（错误反映了这一点）但是如果我从 SQL 命令中删除所有引号它会失败但我的想法是它总是必须是 '"+datahere+"' 是真的吗？

我还将在错误下方为有问题的网络表单引用我的所有代码。当我运行 a 'debug':

时，错误看起来像这样

Incorrect syntax near 't'. Unclosed quotation mark after the character string ')'.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near 't'. Unclosed quotation mark after the character string ')'.

来源错误：

Line 40:             }
Line 41:             SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
Line 42:             cmd.ExecuteNonQuery();
Line 43:             con.Close();
Line 44:             Label1.Visible = true;

源文件：C:\Users\MYNAME\Documents\Visual Studio 2010\Projects\SicknessDBNewSite\SicknessDBNewSite\WebForm2.aspx.cs 行：42

堆栈跟踪：

[SqlException (0x80131904): Incorrect syntax near 't'.
Unclosed quotation mark after the character string ')'.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +1791910
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +5347106
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +546
   System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +1693
   System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) +869
   System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +413
   System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +163
   SicknessDBNewSite.WebForm2.Button1_Click(Object sender, EventArgs e) in C:\Users\MYNAME\Documents\Visual Studio 2010\Projects\SicknessDBNewSite\SicknessDBNewSite\WebForm2.aspx.cs:42
   System.Web.UI.WebControls.Button.OnClick(EventArgs e) +9653178
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +103
   System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +10
   System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +13
   System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +35
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1724

后面的代码： webform2.aspx

    <%@ Page Language="C#" AutoEventWireup="true" CodeBehind="WebForm2.aspx.cs" Inherits="SicknessDBNewSite.WebForm2" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
    <style type="text/css">
        .style1
        {
            width: 72%;
        }
        .style2
        {
            width: 443px;
        }
        .style3
        {
            text-align: center;
            text-decoration: underline;
        }
        .style4
        {
            width: 443px;
            height: 65px;
        }
        .style5
        {
            height: 65px;
        }
        .style6
        {
            text-align: center;
        }
    </style>
</head>
<body>
    <form id="form1" runat="server">
    <div style="text-align: center">
        <h1 class="style3">
            Test Form Submission
        </h1>
        <table class="style1" align="center">
            <tr>
                <td class="style2">
                    Name</td>
                <td>
                    <asp:TextBox ID="txtname" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Grade</td>
                <td>
                    <asp:TextBox ID="txtgrade" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Depot</td>
                <td>
                    <asp:TextBox ID="txtdepot" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Nature of Illness?</td>
                <td>
                    <asp:TextBox ID="txtillness" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Appointment made to see doctor (Yes or No)?</td>
                <td>
                    <asp:RadioButton ID="RadioAppointmentYes" runat="server" Text="Yes" />
                    <asp:RadioButton ID="RadioAppointmentNo" runat="server" Text="No" />
                    <asp:Label ID="LabelAppointment" runat="server" Visible="False"></asp:Label>
</td>
            </tr>
            <tr>
                <td class="style2">
                    Medication Taken (Yes or No)?</td>
                <td class="style6">
                    <asp:RadioButton ID="RadioMedicationYes" runat="server" Text="Yes" />
                    <asp:RadioButton ID="RadioMedicationNo" runat="server" Text="No" />
                    <asp:Label ID="LabelMedication" runat="server" Visible="False"></asp:Label>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Expected length of absence?</td>
                <td>
                    <asp:TextBox ID="txtabsence" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    If not contacted by staff member, who contacted on their behalf?</td>
                <td>
                    <asp:TextBox ID="txtcontactby" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Likely resumption date?</td>
                <td>
                    <asp:TextBox ID="txtresumedate" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Contact telephone number</td>
                <td>
                    <asp:TextBox ID="txtcontactnum" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Latest update date</td>
                <td>
                    <asp:TextBox ID="txtupdate" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style4">
                    Details</td>
                <td class="style5">
                    <asp:TextBox ID="txtdetails" runat="server" Width="500px"></asp:TextBox>
                    </td>
            </tr>
            <tr>
                <td class="style2">
                    Resumption Date</td>
                <td>
                    <asp:TextBox ID="txtresumeddate" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Detail</td>
                <td>
                    <asp:TextBox ID="txtdetail" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Is the person still on medication at the time of resumption?</td>
                <td>
                    <asp:TextBox ID="txtmedonreturn" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Controller / Planner&#39;s name</td>
                <td>
                    <asp:TextBox ID="txtreporter" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Date of contact</td>
                <td>
                    <asp:TextBox ID="txtdateofcontact" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    Date and time of next shift</td>
                <td>
                    <asp:TextBox ID="txtdatetimeshift" runat="server" Width="500px"></asp:TextBox>
                </td>
            </tr>
            <tr>
                <td class="style2">
                    &nbsp;</td>
                <td>
                    <asp:Button ID="Button1" runat="server" onclick="Button1_Click" Text="Submit" Width="100px" />
                </td>
            </tr>
            </table>
    </div>
    <a href="http://INTRANET/webform1.aspx">
     <asp:Label ID="Label1" runat="server" ForeColor="Green" Visible="False" /></asp:Label>
     </a>
    <asp:SqlDataSource ID="SqlDataSource1" runat="server" 
        ConnectionString="<%$ ConnectionStrings:ConnectionStringTestFormSubmission %>" 
        SelectCommand="SELECT * FROM [sicknesstest]"></asp:SqlDataSource>
    </form>
</body>
</html>

webform2.aspx.cs

    using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

namespace SicknessDBNewSite
{
    public partial class WebForm2 : System.Web.UI.Page
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionStringTestFormSubmission"].ConnectionString);

        protected void Page_Load(object sender, EventArgs e)
        {
            con.Open();
        }

        protected void Button1_Click(object sender, EventArgs e)
        {

            if (RadioAppointmentYes.Checked)
            {
                LabelAppointment.Text = "Yes";
            }
            else if (RadioAppointmentNo.Checked)
            {
                LabelAppointment.Text = "No";
            }

            if (RadioMedicationYes.Checked)
            {
                LabelAppointment.Text = "Yes";
            }
            else if (RadioMedicationNo.Checked)
            {
                LabelAppointment.Text = "No";
            }
            SqlCommand cmd = new SqlCommand("insert into sicknesstest values('"+txtname.Text+"','"+txtgrade.Text+"','"+txtdepot.Text+"','"+txtillness.Text+"','"+LabelAppointment.Text+"','"+LabelMedication.Text+"','"+txtabsence.Text+"','"+txtcontactby.Text+"','"+txtupdate.Text+"','"+txtdetails.Text+"','"+txtresumedate.Text+"','"+txtdetail.Text+"','"+txtmedonreturn.Text+"','"+txtreporter.Text+"','"+txtdateofcontact.Text+"','"+txtresumeddate.Text+"')", con);
            cmd.ExecuteNonQuery();
            con.Close();
            Label1.Visible = true;
            Label1.Text = "Your Data has been stored successfully! Click here to view";
            txtname.Text = "";
            txtgrade.Text = "";
            txtdepot.Text = "";
            txtillness.Text = "";
            txtabsence.Text = "";
            txtcontactby.Text = "";
            txtupdate.Text = "";
            txtdetails.Text = "";
            txtresumedate.Text = "";
            txtdetail.Text = "";
            txtmedonreturn.Text = "";
            txtreporter.Text = "";
            txtdateofcontact.Text = "";
            txtresumeddate.Text = "";
        }
    }

}

-- 数据来源：

网络配置：

数据库运行在我的本地计算机上作为 'test bay' 运行，据我所知。

<add name="ConnectionStringTestFormSubmission" connectionString="Data Source=G00069-PC\SQLEXPRESS;Initial Catalog=SicknessDatabase;Persist Security Info=True;User ID=REMOVED;Password=REMOVED"
      providerName="System.Data.SqlClient" />

Answer 1

92.7% ^(a) 的所有 SQL 执行问题如果您在尝试执行之前输出字符串，就会变得很明显。

很可能您在输入字段中的某处有一个杂散的引号，不一定是恶意的 - 它可能是由 oh no, we won't go 或 code doesn't work 或 contact Mr O'Rourke 等原因引起的。

这意味着做类似的事情：

string strcmd = "insert into ...";
// Examine/output strcmd here.
SqlCommand cmd = new SqlCommand(strcmd);
cmd.ExecuteNonQuery();

然后，一旦它开始工作，请查找 "SQL injection attack" 和 "SQL prepared statements" 这两个术语。在某些时候，您会想要开始使用后者来防止前者。

^(a)图无中生有，实际值可能不同:-)

Answer 2

尝试重建你的声明。在 C# 中，我永远不会像那样连接字符串，请为此使用 String.Format。通常你甚至不应该通过这种方式将参数传递给数据库，因为 SQL-injection。尝试使用 SqlParameter.

我认为您的问题是由于某些文本框中的错误值引起的，这在您使用 SqlParameter 时不会发生。

您应该阅读这个 SO-Answer：Inserting values into a SQL Server database using ado.net via C#

Answer 3

我的建议是在查询中使用参数而不是串联。在sql查询中使用参数的例子如下：

IDbCommand command = conn.CreateCommand();
command.CommandText = "SELECT * FROM M_ITEM_SERIAL WHERE ITSR_PLANT_ID = @plantId";

IDbDataParameter plantIdParam = command.CreateParameter();
plantIdParam.ParameterName = "@plantId";
plantIdParam.Direction = ParameterDirection.Input;
plantIdParam.Value = plantId;
command.Parameters.Add(plantIdParam);

字符串 ')' 后 '' 未闭合引号附近的语法不正确

incorrect syntax near '' unclosed quotation mark after the character string ')'

c#

sql-server

asp.net

visual-studio-2010