我有一個表,materials
,另一個,stock_refund
。我單擊按鈕執行這兩個命令以同時更新兩個表,但兩個記錄都進入同一個表。以下是我的代碼:執行兩個不同的命令,但只有一個表正在影響
SqlConnection con = new SqlConnection(@"Data Source=ANONYMOUS\SQLSERVER;Initial Catalog=IndoStar;Integrated Security=SSPI;");
con.Open();
SqlCommand cmd = new SqlCommand("Insert into stock_refund values('"+refund_stockname.Text + "','"+refund_sitename.Text + "','"+refund_day.Text + refund_month.Text + refund_year.Text + "','"+refund_quantity.Text + "','"+ refund_unit.Text+"')",con);
SqlCommand cmd1 = new SqlCommand("Insert into materials values('" + refund_stockname.Text + "','" + refund_day.Text + refund_month.Text + refund_year.Text + "','" + refund_quantity.Text + "','" + refund_unit.Text + "', 'refund','"+ refund_sitename.Text +"')", con);
int i = cmd.ExecuteNonQuery();
int j = cmd.ExecuteNonQuery();
if ((i > 0)&& (j>0))
{
MessageBox.Show("Stock refunded successfully","Information",MessageBoxButtons.OK,MessageBoxIcon.Information);
}
http://www.preshweb.co.uk/2007/10/sql-injection-by-name/ – 2012-08-04 16:57:30
您的命令對[Sql注入攻擊](http://xkcd.com/327/)非常敏感)。你應該真的使用參數化查詢。 – Steve 2012-08-04 16:57:51