VB.Net SQL插入到使用Windows窗體數據

Question

好吧，我已經拿起了我所知道的VB.Net的一切，從試驗和錯誤。我已經構建了一個可以在Access中工作的SQL字符串，並試圖實現它，但是它似乎不適用於我的程序。我完全接受我沒有堅定的把握，所以我做錯了什麼？這種特殊的形式只需要從Windows窗體中的文本框中獲取文本並將其插入到數據庫中。

Dim insertSql As String = "INSERT INTO StudentTable VALUES ('" + BadgeNoTextBox.Text + "','" + FirstNameTextBox.Text + "','" + LastNameTextBox.Text + "','" + SAPSIDTextBox.Text + "','" + EmailTextBox.Text + "'.'" + PhoneTextBox.Text + "','" + CollegeComboBox.Text + "')" 
    conn.ConnectionString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=""C:\Users\larsennicholasg\Documents\Visual Studio 2012\Projects\SSCLogin\SSCLogin\My Project\SSCStudent.mdb""" 
    Dim da As New OleDbDataAdapter(insertSql, conn) 

    If (da.Update(ds)) Then 
     MessageBox.Show("Success") 
    Else 
     MessageBox.Show("Fail") 
    End If 

任何想法？

Answer 1

試試這個：

Dim insertSql As String = "INSERT INTO StudentTable VALUES (?, ?, ?, ?, ?, ?, ?)" 
Dim connStr As String = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=""C:\Users\larsennicholasg\Documents\Visual Studio 2012\Projects\SSCLogin\SSCLogin\My Project\SSCStudent.mdb""" 
Using conn As New OleDbConnection(connStr), _ 
     cmd As New OleDbCommand(insertSql, conn) 

    ''# I had to guess at types and lengths here. 
    ''# Adjust this to use actual types and lengths in your database 
    cmd.Parameters.Add("?", OleDbType.Integer).Value = CInt(BadgeNoTextBox.Text) 
    cmd.Parameters.Add("?", OleDbType.VarWChar, 20).Value = FirstNameTextBox.Text 
    cmd.Parameters.Add("?", OleDbType.VarWChar, 20).Value = LastNameTextBox.Text 
    cmd.Parameters.Add("?", OleDbType.Integer).Value = CInt(SAPSIDTextBox.Text) 
    cmd.Parameters.Add("?", OleDbType.VarWChar, 50).Value = EmailTextBox.Text 
    cmd.Parameters.Add("?", OleDbType.VarChar, 20).Value = PhoneTextBox.Text 
    cmd.Parameters.Add("?", OleDbType.VarWChar, 35).Value = CollegeComboBox.Text 

    conn.Open() 
    cmd.ExecuteNonQuery() 
End Using 

使用的查詢參數，而不是字符串替換是很重要的。你有什麼瘋狂的 - 容易受到SQL注入攻擊。