2013-04-08 89 views
0

我正在嘗試爲我的程序創建一個更新語句,該語句將根據用戶輸入的數據使用SQL更新數據庫,不幸的是我遇到了問題,我可以一次只更新一個,有時沒有一個可以工作。如果有任何幫助可以給予,將不勝感激。爲Access數據庫使用更新語句(Vb 2008)

Private Sub btnsave_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnsave.Click 

    Dim con As New OleDb.OleDbConnection 

    Dim d1 As New OleDb.OleDbDataAdapter 
    Dim d2 As New OleDb.OleDbDataAdapter 
    Dim d3 As New OleDb.OleDbDataAdapter 
    Dim d4 As New OleDb.OleDbDataAdapter 
    Dim d5 As New OleDb.OleDbDataAdapter 
    Dim d6 As New OleDb.OleDbDataAdapter 
    Dim d7 As New OleDb.OleDbDataAdapter 
    Dim d8 As New OleDb.OleDbDataAdapter 
    Dim d9 As New OleDb.OleDbDataAdapter 
    Dim d10 As New OleDb.OleDbDataAdapter 

    Dim dt As New DataTable("Animals") 

    'uses the 2010 compatible connection string 
    con.ConnectionString = "PROVIDER=Microsoft.ACE.OLEDB.12.0;Data Source = h:\Animals.accdb" 
    con.Open() 

    MsgBox("UPDATE Animals SET LatinName = '" & latintxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'") 
    d1 = New OleDb.OleDbDataAdapter("UPDATE Animals SET LatinName = '" & latintxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d2 = New OleDb.OleDbDataAdapter("UPDATE Animals SET LocationFound = '" & locationtxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d3 = New OleDb.OleDbDataAdapter("UPDATE Animals SET AverageHeight = '" & heighttxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d4 = New OleDb.OleDbDataAdapter("UPDATE Animals SET AverageWeight = '" & weighttxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d5 = New OleDb.OleDbDataAdapter("UPDATE Animals SET DietaryNeeds = '" & diettxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d6 = New OleDb.OleDbDataAdapter("UPDATE Animals SET ConservationStatus = '" & statustxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d7 = New OleDb.OleDbDataAdapter("UPDATE Animals SET AverageLifeSpan = '" & lifetxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d8 = New OleDb.OleDbDataAdapter("UPDATE Animals SET BreedingSeason = '" & breedtxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d9 = New OleDb.OleDbDataAdapter("UPDATE Animals SET AverageLength = '" & lengthtxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 
    d10 = New OleDb.OleDbDataAdapter("UPDATE Animals SET AnimalName = '" & nametxt.Text & "'" & " WHERE AnimalName = " & "'" & Form1.txtname.Text & "'", con) 

    d1.Fill(dt) 
    d2.Fill(dt) 
    d3.Fill(dt) 
    d4.Fill(dt) 
    d5.Fill(dt) 
    d6.Fill(dt) 
    d7.Fill(dt) 
    d8.Fill(dt) 
    d9.Fill(dt) 
    d10.Fill(dt) 

    con.Close() 

End Sub 
+0

Google SQL Injection。您已將數據庫打開以進行攻擊。 – APrough 2013-04-08 19:50:12

回答

0

實際的SQL可以像這樣:

update yourtable 
set field1 = something 
, field2 = something else 
etc 

所有你必須與你的.NET代碼做的是創建一個字符串,一如當年。另外,使用查詢參數。

+0

對不起,我試圖使用它們作爲一個字符串,但只是創建了更多的問題與語法和字符串的結構。這似乎是最簡單的方法,但它造成了許多問題。 – Silver 2013-04-08 20:47:05

+0

嬰兒的步驟。讓它與一個領域一起工作。然後逐個添加字段並讓每個字段工作。 – 2013-04-08 22:47:09

1

您的功能非常低效。您應該使用OleDB.OleDBCommand而不是數據適配器。數據適配器主要用於從數據庫獲取數據而不更新數據庫。你可以使用它們來更新數據,但不是你正在做的方式。

試着改變你的函數看起來像這樣:

Using cn As New OleDbConnection(YOURCONNECTIONSTRING) 
    Dim cSQL As String = "THIS WILL BE YOUR SQL" 
    Dim cmd As New OleDbCommand(cSQL, cn) 
    Try 
     If cn.State <> ConnectionState.Open Then cn.Open() 
     cmd.ExecuteNonQuery() 

     'Now reset cSQL to your second SQL string and recreate your OleDbCommand with the new string.' 
     cSQL = "NEW SQL STRING" 
     cmd = New OleDbCommand(cSQL, cn) 
     cmd.ExecuteNonQuery() 

     'Now repeat your process as many times as you like.' 
    Catch ex As Exception 
     'Handle any errors here.' 
    End Try 
End Using 

話雖如此,像其他人所說的,你應該使用命令參數的所有輸入。這有點高級,你應該在自己的時間谷歌周圍教你自己如何做到這一點。有大量的教程會引導你完成整個過程。一旦你學會了如何使用這些參數,你將會很好地保護你未來的項目免受黑客和惡意用戶的侵害。

+0

非常感謝您的幫助,這非常有用,因爲我對編程知識有限。我只是有幾個問題,如果你願意回答它們, VB告訴我oleDBConnection還沒有定義,我應該怎麼做呢? cSQL應該是我唯一的第一個sql語句還是全部? – Silver 2013-04-13 12:51:20

+0

凹凸(我真的需要這方面的幫助) – Silver 2013-04-13 20:54:39

+0

你導入了oledb命名空間嗎?或嘗試聲明您的連接,如oledb.oledbconnection。您傳遞給構造函數的參數也需要是數據庫的連接字符串。變量cSQL應該一次是一個單一的sql命令,每次調用executetenonquery後都應該重置它。我對任何格式和拼寫錯誤表示歉意,並通過移動設備發佈。 – 2013-04-14 13:53:06

相關問題