OleDbException：INSERT INTO語句中的語法錯誤

Question

我得到OleDbException：INSERT INTO語句中的語法錯誤。我認爲我的INSERT INTO聲明很好。參數具有良好的數據類型，所以它沒有問題。有人可能知道有什麼問題嗎？

 OleDbCommand command = new OleDbCommand(); 
     command.Connection = conn; 
     command.CommandType = CommandType.Text; 
     command.CommandText = String.Format("INSERT INTO Employees" + 
      " (ID, Company, Last Name, First Name, E-mail Address, Job Title, Business Phone, Home Phone" + 
      ", Mobile Phone, Fax NUmber, Address, City, State/Province, ZIP/Postal Code, Country/Region, Web Page, Notes)" + 
      " Values ('{0}', '{1}','{2}','{3}','{4}','{5}'," + 
      "'{6}','{7}','{8}','{9}','{10}','{11}','{12}','{13}','{14}','{15}','{16}')", iD,kompanija,prezime,ime,email, 
      zvanje,busTelefon,telefon,mobTelefon,fax,adresa,grad,okrug,postanskiBroj,zemlja,web,beleska);    zvanje,busTelefon,telefon,mobTelefon,fax,adresa,grad,okrug,postanskiBroj,zemlja,web,beleska); 

     conn.Open(); 
     command.ExecuteNonQuery(); 
     conn.Close(); 

錯誤消息：

UDATE SQL：

 OleDbCommand command = new OleDbCommand(); 
     command.Connection = conn; 
     command.CommandType = CommandType.Text; 
     string cmdText = String.Format(@"UPDATE TABLE Employees " + 
         "SET" + 
         " Company='" + kompanija + "'," + 
         " [Last Name]='" + prezime + "'," + 
         " [First Name]='" + ime + "'," + 
         " [E-mail Address]='" + email + "' ," + 
         " [Job Title]='" + zvanje +"'," + 
         " [Business Phone]='" + busTelefon + "'," + 
         " [Home Phone]='" + telefon + "'," + 
         " [Mobile Phone]='" + mobTelefon + "'," + 
         " [Fax Number]='" + fax + "'," + 
         " Address='" + adresa + "'," + 
         " City='" + grad + "'," + 
         " [State/Province]='" + okrug + "'," + 
         " [ZIP/Postal Code]='" + postanskiBroj + "'," + 
         " [Country/Region]='" + zemlja + "'," + 
         " [Web Page]='" + web + "'," + 
         " Notes='" + beleska + "' WHERE ID="+iD); 
     command.CommandText = cmdText; 

     conn.Open(); 
     command.ExecuteNonQuery(); 
     conn.Close(); 

而這個SQL不起作用。像以前一樣的錯誤。

Answer 1

當你的領域名稱包含空格或其他字符誤區，如/（除法運算符），你需要他們被封閉在方括號

string cmdText = @"INSERT INTO Employees 
        (ID, Company, [Last Name], [First Name], [E-mail Address], 
        .., [State/Province], ....) VALUES (....)"; 

而且你是不是在你的查詢中使用的參數。 String.Format只是另一種字符串連接類型，無法通過無效輸入保護您（例如，嘗試在您的姓氏值中使用單引號），並且無法從Sql Injection vulnerability保存您的代碼。

你應該總是使用參數化查詢

string cmdText = @"INSERT INTO Employees (your_field_list_comma_sep) 
        VALUES (@id, @company, @lastname, @firstname, 
        ......)"; 

OleDbCommand cmd = new OleDbCommand(cmdText, conn); 
cmd.Parameters.Add("@id", OleDbType.Integer).Value = iD; 
cmd.Parameters.Add("@company", OleDbType.VarWChar).Value = kompanija; 
cmd.Parameters.Add("@lastname", OleDbType.VarWChar).Value = prezime; 
cmd.Parameters.Add("@firstname", OleDbType.VarWChar).Value = ime; 
.... 
// add all the other parameters with their name and type 
.... 
cmd.ExecuteNonQuery();