SQL update語句

Question

我有表「學生」

P_ID LastName FirstName Address City 

    1  Hansen Ola     
    2  Svendson Tove 
    3  Petterson Kari 
    4  Nilsen  Johan 
...and so on 

如何更改編輯代碼在C＃

string firstName = "Ola"; 
string lastName ="Hansen"; 
string address = "ABC"; 
string city = "Salzburg"; 

string connectionString = System.Configuration.ConfigurationManager 
          .ConnectionStrings["LocalDB"].ConnectionString; 

using (SqlConnection connection = new SqlConnection(connectionString)) 
    using (SqlCommand command = connection.CreateCommand()) 
{ 
    command.CommandText = "INSERT INTO Student (LastName, FirstName, Address, City) 
          VALUES (@ln, @fn, @add, @cit)"; 

    command.Parameters.AddWithValue("@ln", lastName); 
    command.Parameters.AddWithValue("@fn", firstName); 
    command.Parameters.AddWithValue("@add", address); 
    command.Parameters.AddWithValue("@cit", city); 

    connection.Open(); 

    command.ExecuteNonQuery(); 

    connection.Close(); 
} 

編輯條目，其中姓字段姓價值姓氏字段具有名字值。

我不想使用這樣

UPDATE Persons SET Address='Nissestien 67', City='Sandnes' 
WHERE LastName='Tjessem'  AND FirstName='Jakob' 

，我編輯的我原來​​的語句

command.CommandText = "UPDATE Student(LastName, FirstName, Address, City) 
    VALUES (@ln, @fn, @add, @cit) WHERE LastName='" + lastName + 
          "' AND FirstName='" + firstName+"'"; 

但聲明是沒有得到執行，爲什麼會拋出SQL異常？有沒有解決它的辦法？

Answer 1

這不是更新記錄的SQL正確方法：

command.CommandText = "UPDATE Student(LastName, FirstName, Address, City) VALUES (@ln, @fn, @add, @cit) WHERE LastName='" + lastName + "' AND FirstName='" + firstName+"'"; 

你應該寫這樣的：

command.CommandText = "UPDATE Student 
SET Address = @add, City = @cit Where FirstName = @fn and LastName = @add"; 

然後添加相同的參數，你加入他們用於插入操作。

Answer 2

我不想使用這樣

這是在SQLUpdate語句的語法，你必須使用語法，否則你將得到的異常。

command.Text = "UPDATE Student SET Address = @add, City = @cit Where FirstName = @fn and LastName = @add"; 

然後相應地添加您的參數。

command.Parameters.AddWithValue("@ln", lastName); 
command.Parameters.AddWithValue("@fn", firstName); 
command.Parameters.AddWithValue("@add", address); 
command.Parameters.AddWithValue("@cit", city); 

Answer 3

如果您不想使用SQL語法（您不得不這麼做），那麼切換到像Entity Framework或Linq-to-SQL這樣的框架，您不必自己編寫SQL語句。

Answer 4

每種語言都有適當的語法。同樣，SQL（結構化查詢語言）也有更新查詢的特定語法，如果我們想要使用更新查詢，我們必須遵循這個語法。否則它不會給出預期的結果。

Answer 5

string constr = @"Data Source=(LocalDB)\v11.0;Initial Catalog=Bank;Integrated Security=True;Pooling=False"; 
SqlConnection con = new SqlConnection(constr); 
DataSet ds = new DataSet(); 
con.Open(); 
SqlCommand cmd = new SqlCommand(" UPDATE Account SET name = Aleesha, CID = 24 Where name =Areeba and CID =11)"; 
cmd.ExecuteNonQuery(); 

Answer 6

String st = "UPDATE supplier SET supplier_id = " + textBox1.Text + ", supplier_name = " + textBox2.Text 
      + "WHERE supplier_id = " + textBox1.Text; 

     SqlCommand sqlcom = new SqlCommand(st, myConnection); 
     try 
     { 
      sqlcom.ExecuteNonQuery(); 
      MessageBox.Show("update successful"); 
     } 
     catch (SqlException ex) 
     { 
      MessageBox.Show(ex.Message); 
     } 

Answer 7

private void button4_Click(object sender, EventArgs e) 
    { 
     String st = "DELETE FROM supplier WHERE supplier_id =" + textBox1.Text; 

     SqlCommand sqlcom = new SqlCommand(st, myConnection); 
     try 
     { 
      sqlcom.ExecuteNonQuery(); 
      MessageBox.Show("刪除成功"); 
     } 
     catch (SqlException ex) 
     { 
      MessageBox.Show(ex.Message); 
     } 
    } 



    private void button6_Click(object sender, EventArgs e) 
    { 
     String st = "SELECT * FROM suppliers"; 

     SqlCommand sqlcom = new SqlCommand(st, myConnection); 
     try 
     { 
      sqlcom.ExecuteNonQuery(); 
      SqlDataReader reader = sqlcom.ExecuteReader(); 
      DataTable datatable = new DataTable(); 
      datatable.Load(reader); 
      dataGridView1.DataSource = datatable; 
      //MessageBox.Show("LEFT OUTER成功"); 
     } 
     catch (SqlException ex) 
     { 
      MessageBox.Show(ex.Message); 
     } 
    } 

Answer 8

command.Text = "UPDATE Student 
    SET Address = @add, City = @cit 
    Where FirstName = @fn and LastName = @add"; 

 

Answer 9

請，從來不使用這個CONCAT形式：

String st = "UPDATE supplier SET supplier_id = " + textBox1.Text + ", supplier_name = " + textBox2.Text 
     + "WHERE supplier_id = " + textBox1.Text; 

使用：

command.Parameters.AddWithValue("@attribute", value); 

始終面向工作對象

編輯：這是因爲當您更新參數時，它有助於防止SQL注入。