使用会话更新数据库不工作 C# SQL

Question

所以我的代码带来了搜索到的讲师用户ID和用户之前选择的模块ID。但是它在这条线上中断了；

myCommand.ExecuteNonQuery();

错误是；

An exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll but was not handled in user code

Additional information: Incorrect syntax near '('.

我不知道为什么会这样，但我可以看到当我使用断点时我的东西被拉过。

前端代码：

<asp:SqlDataSource ID="SqlDataSource1" runat="server" ConnectionString="<%$ ConnectionStrings:DefaultConnection %>" 
            SelectCommand="SELECT Lecturer_Records.UserID, Lecturer_Records.FirstName, Lecturer_Records.Surname, Lecturer_Records.PhoneNumber, Users.Email 
            FROM Lecturer_Records 
            INNER JOIN Users ON Lecturer_Records.UserID = Users.UserID 
            WHERE (Users.Email = @email)">
            <SelectParameters>
                <asp:QueryStringParameter Name="email" QueryStringField="searchlects" />
                <asp:SessionParameter Name="ModuleID" SessionField="ModuleID" Type="Int32" />
            </SelectParameters>
        </asp:SqlDataSource>




        <asp:GridView ID="SearchResult" runat="server" AutoGenerateColumns="False" AutoGenerateSelectButton="True"  DataSourceID="SqlDataSource1" OnSelectedIndexChanged="SearchResult_SelectedIndexChanged">
            <Columns>
                <asp:BoundField DataField="UserID" HeaderText="UserID" SortExpression="UserID" />
                <asp:BoundField DataField="FirstName" HeaderText="FirstName" SortExpression="FirstName" />
                <asp:BoundField DataField="Surname" HeaderText="Surname" SortExpression="Surname" />
                <asp:BoundField DataField="PhoneNumber" HeaderText="PhoneNumber" SortExpression="PhoneNumber" />
                <asp:BoundField DataField="Email" HeaderText="Email" SortExpression="Email" />
            </Columns>
        </asp:GridView>

还有我的 C# 代码

    protected void SearchResult_SelectedIndexChanged(object sender, EventArgs e)
    {

     // open new connection
        SqlConnection connection1 = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString);
        connection1.Open();

        string SearchUser = SearchResult.SelectedRow.Cells[1].Text;
        string Module = (string)Session["ModuleID"];

        SqlCommand myCommand = new SqlCommand("UPDATE [Modules] SET (UserID = '" + SearchUser + "') WHERE (ModuleID = '" + Module + "')", connection1);


        myCommand.ExecuteNonQuery();
        // move on to home page
        Response.Redirect("APMDefault.aspx");
    }

Answer 1

您的命令中不需要任何 ( 或 )。他们破坏了你的 sql 语法。删除它们即可。

但更重要的是，您应该始终使用 parameterized queries. This kind of string concatenations are open for SQL Injection 攻击。

根据您的列名，它们似乎是数字类型。这意味着，您可能还需要删除单引号。如果你使用prepared statements，你当然不需要这个。

并使用using语句来处理你的连接和命令。

using(var connection1 = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString))
using(var myCommand = connection1.CreateCommand())
{
     myCommand.CommandText = @"UPDATE Modules SET UserID = @userid 
                               WHERE ModuleID = @moduleid";
     myCommand.Parameters.Add("@userid", SqlDbType.NVarChar).Value = SearchUser;   
     myCommand.Parameters.Add("@moduleid", SqlDbType.NVarChar).Value = Module;
     // I assumed your column types are nvarchar
     connection1.Open();
     myCommand.ExecutenonQuery();
     // move on to home page
     Response.Redirect("APMDefault.aspx");
}

但实际上，那些列似乎是数字类型。您可以更改他们的类型或更改他们的名称，将他们的类型指向字符。

使用会话更新数据库不工作 C# SQL

Updating Database with sessions not working C# SQL

c#

sql

sql-update

session-variables

sqlcommand