錯誤保存到數據庫的組合框

Question

我收到以下錯誤：

error : you have an error in your sql syntax.check the manual that corresponds to your mysql server version for the right syntax to use near 'SOFTWARE DEVELOPER' at line 1.

這是我的代碼：

Imports MySql.Data.MySqlClient 

Public Class Form2 

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click 

    Dim conStr As String = ("server=localhost;username=root;password=rootfnc;database=one") 
    Try 
     Dim con As New MySqlConnection(conStr) 
     Dim cmd As MySqlCommand 

     For i = 0 To ComboBox1.Items.Count 
      con.Open() 

      Dim sqls As String 
      sqls = "insert into one.initial_nom (idinitial_nom, f_name, s_name, th_name, fo_name, app_no, adm_type) values ('" & TextBox6.Text & "','" & TextBox1.Text & "', '" & TextBox2.Text & "', '" & TextBox3.Text & "', '" & TextBox4.Text & "', '" & TextBox5.Text & ",'" & ComboBox1.Items(i).ToString & "')" 
      cmd = New MySqlCommand(sqls, con) 
      cmd.ExecuteNonQuery() 
     Next 
    Catch ex As Exception 
     MsgBox("Error in saving to Database. Error is :" & ex.Message) 
    End Try 
End Sub 

有誰知道錯誤是怎麼引起的？

Answer 1

您沒有正確封閉所有你插入撇號中字符串的值：

... '" & TextBox5.Text & "_,'" & ComboBox1.Items(i).ToString & "')" 

通知，我已經把下劃線，TextBox5.Text串接到後弦：應該有那裏有一個關閉的撇號，在逗號前。

現在，事實上，您不應該首先將用戶輸入的SQL命令連接在一起，而應該使用SqlCommand的SqlParameter collection準備語句。這裏有一個簡化的例子：

sqls = "insert into tableName (column1) values (@parameterName)" 
cmd = New MySqlCommand(sqls, con) 
cmd.Parameters.Add(new MySqlParameter("@parameterName", TextBox5.Text)) 
' ... 
' <snip - set other parameters as needed> 
' ... 
cmd.ExecuteNonQuery()