必須在SQL INSERT語句中定義縮放變量

Question

我正在嘗試編寫具有3個文本框的代碼，並且需要將輸入到框中的信息傳遞給SQL數據庫，然後將其顯示在一個gridview，用作購物車。我一直在我的catch塊中發現一個錯誤，那就是說我必須定義@strItemName的標量變量。這是我的代碼...任何幫助將非常讚賞。如果這段代碼在網站上的格式不正確，這是我的第一篇文章。提前致謝。

protected void btnSubmit_Click(object sender, EventArgs e) 
    { 
     string strItemName = txtTitle.Text; 
     string strMovieQuantity = txtNumMovies.Text; 
     string strMoviePrice = txtPrice.Text; 
     //string strCurrentUser = HttpContext.Current.User.Identity.Name; 
     // I need this later to have a current user also inserted into the table 



     string strConnection = ConfigurationManager.ConnectionStrings["cs3200"].ToString(); 
     SqlConnection myConnection = new SqlConnection(strConnection); 

     string strSql = "INSERT INTO ShoppingCart ([ItemName], [QuantityOrdered], [UnitPrice]) VALUES (@strItemName, @strQuantityOrdered, @strUnitPrice)"; 
     SqlCommand myCommand = new SqlCommand(strSql, myConnection); 



     try 
     { 
      myConnection.Open(); 
      int intCnt = myCommand.ExecuteNonQuery(); 
      if (intCnt > 1) 
      { 
       lblInsert.Text = intCnt.ToString() + "Records was added"; 
      } 
      else 
      { 
       lblInsert.Text = "One Record was inserted"; 
      } 
      myConnection.Close(); 
     } 


     catch (Exception ex) 
     { 
      lblInsert.Text = "Unable to insert your record" + "</br>"; 
      lblInsert.Text += "Error Message = " + ex.Message; 
      myConnection.Close(); 
     } 

Answer 1

您必須在調用ExecuteNonQuery（）方法之前指定參數。

using(SqlConnection myConnection=new SqlConnection(cnStr)) 
    { 
    using(SqlCommand myCommand=new SqlCommand(strSql,myConnection)) 
    { 
    myCommand.Parameters.AddWithValue("@strItemName",value1); 
    myCommand.Parameters.AddWithValue("@strQuantityOrdered",value2); 
    myCommand.Parameters.AddWithValue("@strUnitPrice",value3); 
    myConnection.Open(); 
    int intCnt = myCommand.ExecuteNonQuery(); 
    .... 
    } 
    } 

Answer 2

如果你想使用 「準備好的語句」（始終是可取的），你需要做這樣的事情：

• http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.prepare%28v=vs.71%29.aspx

  rConn.Open() 
  Dim command As SqlCommand = New SqlCommand("", rConn) 
  ' Create and prepare an SQL statement. 
  command.CommandText = "insert into Region (RegionID, RegionDescription) values (@id, @desc)" 
  command.Parameters.Add("@id", id) 
  command.Parameters.Add("@desc", desc) 
  command.Prepare() ' Calling Prepare after having set the Commandtext and parameters. 
  command.ExecuteNonQuery() 
  

如果你只是想要一個簡單的「插入」，那麼你可以做這樣的事情：

string sql = 
    "insert into Region (RegionID, RegionDescription) values ('" + id + 
    "', '" + desc + "')"; 
SqlCommand command = new SqlCommand(sql); 
command.ExecuteNonQuery()