我無法執行的SqlCommand

Question

好傢伙我有這個代碼

cmd = new SqlCommand(); 
cmd.Connection = baglanti; 

cmd.CommandText = "(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) VALUES('" + txtMusteriAdi.Text.Trim() + "','" + txtMusteriSoyadi.Text.Trim() + "','" + txtGsm.Text.Trim() + "','" +txtEmail.Text.Trim() + "','" +txtSirketAdi.Text.Trim() + "','" +txtAdres.Text.Trim() + "','" +txtNotlar.Text.Trim() +"');"; 
baglanti.Open(); 
cmd.ExecuteNonQuery(); 

baglanti.Close(); 

我所定義的CMD爲public SqlCommmand，並在每一次當代碼來它屬於趕上我能做些什麼的cmd.ExecuteNonQuery() 。

Answer 1

因爲您忘記了INSERT INTO部分供您發言。喜歡;

INSERT INTO tableName(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) 

但更重要的是，你應該總是使用parameterized queries。這種字符串連接對於SQL Injection攻擊是開放的。

還可以使用using statement處置你的連接，並自動指揮代替手動調用Close方法。

using(var baglanti = new SqlConnnection(yourConnectionString)) 
using(var cmd = baglanti.CreateCommand()) 
{ 
    cmd.CommandText = @"INSERT INTO tableName(musteriadi,musterisoyadi,gsm,email,sirketadi,Adres,Notlar) 
         VALUES(@ad, @soyad, @gsm, @email, @sirket, @adres, @notlar)"; 
    // Add your parameters values with Add method considering their types and size. 
    baglanti.Open(); 
    cmd.ExecuteNonQuery(); 
}