2012-12-06 23 views
0

有沒有辦法使用參數插入查詢?我嘗試時遇到以下錯誤。Petapoco和參數

/// <summary> 
    /// Set active survey 
    /// </summary> 
    public int SetSurveyActive(int brandId, int surveyId) 
    { 
     Sql sql = new Sql() 
      .Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId") 
      .Append("VALUES(@0,@1)",brandId,surveyId); 

     var result = database.Execute(sql); 

     return Convert.ToInt32(result); 
    } 

enter image description here

+0

哇,這似乎是SQL注入的地方。 –

+0

這就是爲什麼我使用參數:) – chobo

回答

5

你缺少一個支架:

.Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId") 

應該

.Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId)")