它說command.ExecuteNonQuery（）未初始化

Question

我的代碼：

// Get Connection String 
string conn = WebConfigurationManager.ConnectionStrings["GraduatesConnectionString"].ToString(); 
// Create connection object 
SqlConnection connection = new SqlConnection(conn); 
SqlCommand command = connection.CreateCommand(); 
try 
{ 
    // Open the connection. 
    connection.Open(); 
    // Execute the insert command. 
    command.CommandText = ("INSERT INTO PersonalInfo(Id,Name,LastName,ContactNumber, Address,Gender, Date_Of_Birth) VALUES(\'" 
       + (this.txtID.Text + ("\',\'" 
       + (this.txtName.Text + ("\',\'" 
       + (this.txtLastName.Text + ("\',\'" 
       + (this.txtContactNumber.Text + ("\',\'" 
       + (this.txtAddress.Text + ("\',\'" 
       + (this.gender + ("\',\'" 
       + (this.txtDateofBirth.Text + ("\',\'" 
      ))))); 
    command.ExecuteNonQuery(); 
} 
finally 
{ 
    // Close the connection. 
    connection.Close(); 
} 

Answer 1

using (SqlConnection connection = new SqlConnection(connectionString)) 
using (SqlCommand command = connection.CreateCommand()) 
{ 
    command.CommandText = "INSERT INTO PersonalInfo (Id, Name, LastName, ContactNumber, Address, Gender, Date_Of_Birth) VALUES (@Id, @Name, @LastName, @LastName, @Address, @Gender, @DateOfBirth)"; 

    command.Parameters.AddWithValue("@Id", txtID.Text); 
    ... 

    connection.Open(); 
    command.ExecuteNonQuery(); 
} 

Answer 2

你以後txtDateofBirth所以你的說法是不完整的缺少一個右)。

但是請注意@podiluska的評論。這段代碼很容易被濫用。假設我在txtDateofBirth輸入類似下面的文字：

;DROP TABLE PersonalInfo; 

然後你得到這樣的查詢：

INSERT INTO PersonalInfo(...) 
VALUES (...);DROP TABLE PersonalInfo; 

所以請使用參數化查詢由@abatishchev描述。

Answer 3

我會忍不住對你的代碼更改爲：

string conn = WebConfigurationManager.ConnectionStrings["GraduatesConnectionString"].ToString(); 
// Create connection object 
using(SqlConnection connection = new SqlConnection(conn)) 
{ 
    string queryText = "INSERT INTO PersonalInfo(Id,Name,LastName,ContactNumber, Address,Gender, Date_Of_Birth) VALUES(@id,@name,@lastName,@contactNumber, @address,@gender, @date_Of_Birth)"; 

    using(SqlCommand command = new SqlCommand(queryText, connection)) 
    { 
     try 
     { 
      // Open the connection. 
      connection.Open(); 

      command.Parameters.AddWithValue("@id", this.txtID.Text); 
      command.Parameters.AddWithValue("@name", this.txtName.Text); 
      command.Parameters.AddWithValue("@lastName", this.txtLastName.Text); 
      command.Parameters.AddWithValue("@contactNumber", this.txtContactNumber.Text); 
      command.Parameters.AddWithValue("@address", this.txtAddress.Text); 
      command.Parameters.AddWithValue("@gender",this.gender); 
      command.Parameters.AddWithValue("@date_Of_Birth", this.txtDateofBirth.Text); 
      command.ExecuteReader(); 
     } 
     finally 
     { 
      // Close the connection. 
      if(connection.State != ConnectionState.Closed) 
       connection.Close(); 
     } 
    } 
}