C＃MySql.Data INSERT INTO錯誤

Question

我在c＃中使用MySql.Data作爲mysql連接。在另一個程序工作，但目前我掛在INSERT INTO命令。

我得到以下錯誤：

An unhandled exception of type 'MySql.Data.MySqlClient.MySqlException' occurred in MySql.Data.dll 
Additional information: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'key) VALUES ('PGJWZBPOWTRPUTKY')' at line 1 

有了這個代碼：

MySqlCommand Command = Connection.CreateCommand(); 
     MySqlDataReader Reader; 
     Command.CommandText = "INSERT INTO jt_teamsync (key) VALUES ('" + TeamSyncKey + "')"; 
     Connection.Open(); 
     Reader = Command.ExecuteReader(); 
     Connection.Close(); 

感謝所有幫助

Answer 1

KEY是MySQL中的保留關鍵字。應該使用反引號轉義，

INSERT INTO jt_teamsync (`key`) VALUES(...) 

• MySQL Reserved Keywords List

一點題外話，您的查詢是非常弱的。這是易受傷害的SQL Injection。參數從我在看如果不告訴你的直接錯誤是什麼幾乎以避免它的價值，如

string content = TeamSyncKey; 
string connStr = "connection string here"; 
string sqlStatement = "INSERT INTO jt_teamsync (`key`) VALUES (@key)"; 
using (MySqlConnection conn = new MySqlConnection(connStr)) 
{ 
    using(MySqlCommand comm = new MySqlCommand()) 
    { 
     comm.Connection = conn; 
     comm.CommandText = sqlStatement; 
     comm.CommandType = CommandType.Text; 

     comm.Parameters.AddWithValue("@key", content); 

     try 
     { 
      conn.Open(); 
      comm.ExecuteNonQuery(); 
     } 
     catch(MySqlException e) 
     { 
      // do something with the exception 
      // do not hide it 
      // e.Message.ToString() 
     } 
    } 
}