更新聲明不以某種形式工作

Question

我是C＃編程新手。我已經創建了一個解決方案，在該解決方案中我已經創建了三個項目。一個項目包含登錄頁面。該項目工作正常，但其他兩個項目中的某些表單不能正常工作。更新語句不起作用，而所有項目中都使用相同的更新語句格式。 任何人都可以給我一個提示，我可能會誤解我嗎？

if (frmMode == "Update") 
     { 
      int RecPos = this.BindingContext[estDataSet, "uoms_v"].Position; 
      string DsUOMCode = estDataSet.Tables["UOMS_V"].Rows[RecPos]["UOM_Code"].ToString(); 
      string TbUOMCode = this.txtUOMCode.Text; 
      string SetClause = ""; 
      if (DsUOMCode != TbUOMCode) 
      { 
       SetClause = "Set UOM_Code= " + "'" + TbUOMCode + "'"; 
       //pmacsDataSet.Tables["UOMS"].Rows[RecPos]["UOM_Code"] = TbUOMCode; 
      } 

      string DsDescp = estDataSet.Tables["UOMS_V"].Rows[RecPos]["Descp"].ToString(); 
      string TbDescp = this.txtDescp.Text; 
      if (DsDescp != TbDescp) 
      { 
       if (SetClause == "") 
       { 
        SetClause = "Set Descp= " + "'" + TbDescp + "'"; 
        estDataSet.Tables["UOMS_V"].Rows[RecPos]["Descp"] = TbDescp; 
       } 
       else 
       { 
        SetClause = SetClause + "," + "Descp= " + "'" + TbDescp + "'"; 
        estDataSet.Tables["UOMS_V"].Rows[RecPos]["Descp"] = TbDescp; 
       } 
      } 

      string DsRemark = estDataSet.Tables["UOMS_V"].Rows[RecPos]["Remark"].ToString(); 
      string TbRemark = this.txtRemark.Text; 
      if (DsRemark != TbRemark) 
      { 
       if (SetClause == "") 
       { 
        SetClause = "Set Remark= " + "'" + TbRemark + "'"; 
        estDataSet.Tables["UOMS_V"].Rows[RecPos]["Remark"] = TbRemark; 
       } 
       else 
       { 
        SetClause = SetClause + "," + "Remark= " + "'" + TbRemark + "'"; 
        estDataSet.Tables["UOMS_V"].Rows[RecPos]["Remark"] = TbRemark; 
       } 
      } 

      if (SetClause == "") 
      { 
       MessageBox.Show("There are no changes in field values to be saved"); 
      } 
      else 
      { 
       MySqlConnection conn = new MySqlConnection(connstr); 
       string UpdStmt = "Update UOMS_V " + SetClause + " WHERE UOM_Code= " + "'" + DsUOMCode + "'"; 
       MySqlCommand cmd = new MySqlCommand(UpdStmt, conn); 
       try 
       { 
        //MessageBox.Show(UpdStmt); 
        conn.Open(); 
        cmd.ExecuteNonQuery(); 
        MessageBox.Show("Record successfully updated"); 
        estDataSet.Tables["UOMS_V"].Clear(); 
        frmQueryMode(); 
        btnSave.Enabled = false; 
        btnModify.Enabled = false; 
        btnFind.Enabled = false; 
        btnDelete.Enabled = false; 
        btnSearch.Enabled = true; 
        btnCreate.Enabled = true; 
       } 
       catch (Exception ex) 
       { 
        MessageBox.Show("Error: " + ex); 
       } 
       finally 
       { 
        conn.Close(); 
       } 
      } 

UOMS是更新工作的形式。在所有其他形式中使用相同的代碼，其中一些形式的綁定上下文值在文本框值發生更改後立即更改！

Answer 1

正如其他人已經指出的那樣，通過構建您的sql語句，您可以對sql注入開放，並對其進行參數化。我會建議按照下面我介紹的內容進行操作。創建你的命令，啓動語法。對於需要更新的每個字段，將其添加到列表中並立即設置它的參數。最後，添加你的WHERE標準，然後執行它。

int RecPos = this.BindingContext[estDataSet, "uoms_v"].Position; 
string DsUOMCode = estDataSet.Tables["UOMS_V"].Rows[RecPos]["UOM_Code"].ToString(); 
string TbUOMCode = this.txtUOMCode.Text; 

string DsDescp = estDataSet.Tables["UOMS_V"].Rows[RecPos]["Descp"].ToString(); 
string TbDescp = this.txtDescp.Text; 

string DsRemark = estDataSet.Tables["UOMS_V"].Rows[RecPos]["Remark"].ToString(); 
string TbRemark = this.txtRemark.Text; 

if ( DsUOMCode == TbUOMCode 
    && DsDescp == TbDescp 
    && DsRemark == TbRemark) 
{ 
    MessageBox("No changes made"); 
    return; 
} 

MySqlConnection conn = new MySqlConnection(connstr); 
string UpdStmt = "update UOMS_V set " 
MySqlCommand cmd = new MySqlCommand("", conn); 
string AddComma = ""; 

if (DsUOMCode != TbUOMCode) 
{ 
    // just continue to add the build string 
    UpdStmt += " UOM_Code = ?parmUOM_Code "; 
    cmd.Parameters.AddWithValue("?parmUOM_Code", TbUOMCode); 
    // in case any additional components to be updated you can 
    // add a "," between each update field component. 
    AddComma = ","; 
} 

if (DsDescp != TbDescp) 
{ 
    // in case the TbUOMCode had something, add comma BEFORE this field instance 
    UpdStmt += AddComma + " Descp = ?parmDescp "; 
    cmd.Parameters.AddWithValue("?parmDescp", TbDescp); 
    // in case any additional components to be updated you can 
    // add a "," between each update field component. 
    AddComma = ","; 
} 

if (DsRemark != TbRemark) 
{ 
    // in case the TbUOMCode had something, add comma BEFORE this field instance 
    UpdStmt += AddComma + " Remark = ?parmRemark "; 
    cmd.Parameters.AddWithValue("?parmRemark", TbRemark); 
    // in case you want to add any MORE change columns after this one 
    AddComma = ","; 
} 

// Now, tack on the WHERE clause... 
UpdStmt += " WHERE UOM_Code = ?parmWhereUOMCode " 
cmd.Parameters.AddWithValue("?parmWhereUOMCode", DsUOMCode); 

// Now, since we changed the "UpdStmt" value from its original command creation, 
// just update the commandText property.... leave parameters alone 
cmd.CommandText = UpdStmt; 

// Then apply your try/catch 
try 
{ 
    // open the connection 
    // execute it... etc 
} 
catch 
{ 
} 

一個補充說明...我在哪裏有「？parmWhatever」，「？」告訴MySQL連接/命令處理程序..您可以在命令對象列表中找到一個參數，並且其名稱引用是「？parmWhatever」...使用IT值作爲實際的插入/更新。

現在，這對您來說可能會更安全一些，但是由於我事先做了預先驗證，至少SOMETHING已更改。所以，如果你想，在這之後，你可以只寫爲

MySqlConnection conn = new MySqlConnection(connstr); 
string UpdStmt = "update UOMS_V " 
       + " set UOM_Code = ?parmUOM_Code, " 
       + "  Descp = ?parmDescp, " 
       + "  Remark = ?parmRemark " 
       + " where UOM_Code = ?parmWhereUOM_Code "; 

MySqlCommand cmd = new MySqlCommand(UpdStmt, conn); 
cmd.Parameters.AddWithValue("?parmUOM_Code", TbUOMCode); 
cmd.Parameters.AddWithValue("?parmDescp", TbDescp); 
cmd.Parameters.AddWithValue("?parmRemark", TbRemark); 
cmd.Parameters.AddWithValue("?parmWhereUOMCode", DsUOMCode); 

// Then apply your try/catch 
try 
{ 
    // open the connection 
    // execute it... etc 
} 
catch 
{ 
} 

這可能是更容易，因爲它只是建立了對所有3種可能的變化和WHERE子句的一次。這應該是確定的，因爲您知道MINIMUM ONE列已更改並需要發送更新。所以，如果只有一個改變了，而另外一個保持不變，那麼通過更新表格並將其中一列設置爲與之相同的值，不會傷害任何東西，但正如您所看到的那樣，使可讀性/易管理性更容易。