在C＃PROGRAME使用SQL Server插入語句

Question

大家好我試圖插入從我的前端到SQL Server database.here獲得的值是我的代碼

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Web; 
using System.Web.UI; 
using System.Web.UI.WebControls; 
using Geocoding.Google; 
using Geocoding; 
using System.Data.SqlClient; 
public partial class regforswa : System.Web.UI.Page 
{ 
    protected void Page_Load(object sender, EventArgs e) 
    { 

    } 
    protected void Button1_Click(object sender, EventArgs e) 
    { 
     string lat; 
     string longi; 
     IGeocoder geocoder = new GoogleGeocoder() { }; 
     Address[] addresses = 
     geocoder.Geocode(TextBox4.Text+TextBox5.Text+TextBox6.Text).ToArray(); 
     foreach (Address adrs in addresses) 
     { 
      //Response.Write("lat=" +adrs.Coordinates.Latitude.ToString()); 
      //Response.Write("longi="+ adrs.Coordinates.Longitude.ToString()); 
     } 
     SqlConnection conn = new SqlConnection("Data Source=ADMIN-PC\\SQLEXPRESS;Initial Catalog=swa1;User Id=swa1;Password=swa1;");//datasource=localhost name,initial catalog=db name 
     //integrated security=windiws authentication OR for sql authentication specify 
     //userid and password 
     conn.Open();//opens connection with the database 
     try 
     {//exeption handling 

      String uname=TextBox1.Text; 
      String pwd=TextBox3.Text; 
      String mnumber = TextBox7.Text; 
      String sques = DropDownList1.Text; 
      String res = TextBox8.Text; 
      String adress = TextBox4.Text; 
      String cty = TextBox5.Text; 
      String zpcode = TextBox6.Text; 
      // Response.Write("uname"+uname +"pwd"+ pwd); 
      SqlCommand newcomm = new SqlCommand("INSERT INTO regforswa(username,password,mno,sq,response,address,city,zipcode) VALUES (uname,pwd,mnumber,sques,res,adress,cty,zpcode)", conn); 
      if (newcomm.ExecuteNonQuery() == 1) 
      {    
       result.Visible = true; 
       result.Text = "entered successfully"; 
      } 
      else 
      { 
       result.Text = "not entered"; 
      } 
     } 
     catch (Exception ex) 
     { 
      Response.Write(ex.Message); 
     } 
     finally 
     { 
      conn.Close(); 
     } 
    } 

} 

，但我得到這個錯誤

無效的列名稱'uname'。無效的列名稱'pwd'。無效列 名稱'mnumber'。無效的列名稱'sques'。無效的列名稱 'res'。無效的列名稱'adress'。無效的列名稱'cty'。 列名稱'zpcode'無效。

我檢查了我的數據庫列名稱，它很完美。請有人help.Why我得到這個錯誤？

Answer 1

在INSERT命令中，您不能以這種方式直接傳遞變量值。您可以使用參數佔位符，那麼你建立你的命令

string uname=TextBox1.Text; 
    string pwd=TextBox3.Text; 
    string mnumber = TextBox7.Text; 
    string sques = DropDownList1.Text; 
    string res = TextBox8.Text; 
    string adress = TextBox4.Text; 
    string cty = TextBox5.Text; 
    string zpcode = TextBox6.Text; 
    SqlCommand newcomm = new SqlCommand(@"INSERT INTO regforswa 
      (username,password,mno,sq,response,address,city,zipcode) VALUES 
      (@uname,@pwd,@mnumber,@sques,@res,@adress,@cty,@zpcode)", conn); 
    newcomm.Parameters.AddWithValue("@uname", uname); 
    ..... and so on for the other parmaters required by the placeholders 

    if (newcomm.ExecuteNonQuery() == 1) 

同樣的參數集合，請記住，這些參數應鍵入你的領域究竟如何需要。例如，如果字段mno的類型是整數，那麼您需要轉換該參數的值。

 newcomm.Parameters.AddWithValue("@mnumber", Convert.ToInt32(mnumber));