2016-06-28 69 views
0

我執行UPDATE或與WHERE聲明INSERT命令,我已經得到了這個錯誤:火鳥未知令牌哪裏

enter image description here

這裏是我的代碼:

private void dataGridView1_CellEndEdit(object sender, DataGridViewCellEventArgs e) 
{ 
    try 
    { 
    FbConnection con = new FbConnection(@"User = SYSDBA; Password = masterkey; Database = D:\TDWORK.fdb; DataSource = localhost; Port = 3050; Dialect = 3; Charset = NONE; Role = admin; Connection lifetime = 15; Pooling = true; MinPoolSize = 0; MaxPoolSize = 50; Packet Size = 8192; ServerType = 0; "); 
    FbCommand cmd = new FbCommand("UPDATE OR INSERT INTO ZAPOSLENI (ULOGA) VALUES (" + dataGridView1.Rows[e.RowIndex].Cells[e.ColumnIndex].Value.ToString() + ") WHERE ZAPID = " + dataGridView1.Rows[e.RowIndex].Cells[0].Value + " ", con); 
    con.Open(); 
    cmd.ExecuteNonQuery(); 
    con.Close(); 
    } 
    catch (Exception ex) 
    { 
    MessageBox.Show(ex.ToString()); 
    } 
} 

這裏是如何命令看起來像調試器在其中插入值時:

UPDATE OR INSERT INTO ZAPOSLENI (ULOGA) VALUES (1) WHERE ZAPID = 0 
+0

您當前的代碼是不安全的,因爲它是開放的SQL注入。你應該真的使用參數。 –

+0

你是什麼意思 – Pacijent

+0

你將值連接到查詢字符串中,這是不安全的。您需要使用參數,請參閱示例[此答案](http://stackoverflow.com/a/10438372/466862) –

回答

2

在插入或更新子句中不能使用WHERE(請參閱UPDATE OR INSERT)。如果你想插入行,當有與ZAPID = 0沒有記錄使用如下語句:

UPDATE OR INSERT INTO ZAPOSLENI (ZAPID, ULOGA) VALUES (0, 1) MATCHING (ZAPID) 

編輯:完整的示例

private void dataGridView1_CellEndEdit(object sender, DataGridViewCellEventArgs e) 
{ 
    try 
    { 
     FbConnection con = new FbConnection(@"User = SYSDBA; Password = masterkey; Database = D:\TDWORK.fdb; DataSource = localhost; Port = 3050; Dialect = 3; Charset = NONE; Role = admin; Connection lifetime = 15; Pooling = true; MinPoolSize = 0; MaxPoolSize = 50; Packet Size = 8192; ServerType = 0; "); 
     FbCommand cmd = new FbCommand("UPDATE OR INSERT INTO ZAPOSLENI (ZAPID, ULOGA) VALUES (" + dataGridView1.Rows[e.RowIndex].Cells[e.ColumnIndex].Value.ToString() + ", " + dataGridView1.Rows[e.RowIndex].Cells[0].Value + ") MATCHING (ZAPID)", con); 
     con.Open(); 
     cmd.ExecuteNonQuery(); 
     con.Close(); 
    } 
    catch (Exception ex) 
    { 
     MessageBox.Show(ex.ToString()); 
    } 
} 
+0

它不起作用。它表示更新或插入與MATCHING子句不匹配。這裏是命令: 'FbCommand cmd = new FbCommand(「UPDATE or INSERT INTO ZAPOSLENI(ULOGA)VALUES(」+ dataGridView1.Rows [e.RowIndex] .Cells [e.ColumnIndex] .Value.ToString()+「) MATCHING(ZAPID)「,con);' – Pacijent

+0

我想你必須在列和值中包含'ZAPID',就像我在答案中所做的那樣。 – scher

+0

答案對你有幫助嗎? – scher