附近有語法錯誤 'S'

Question

我得到​​錯誤..錯誤：Incorrect syntax near 's'

代碼：

con = new SqlConnection("Data Source=DELL-PC;Initial Catalog=sashi;Integrated Security=True"); 
con.Open(); 
SqlCommand sc = new SqlCommand("INSERT INTO Login VALUES('" + textBoxUID.Text + "','" + textBoxPWD.Text + "','" + comboBoxQUN.Text + "','" + textBoxANS.Text + "') ", con); 

sc.ExecuteNonQuery(); 
MessageBox.Show("Record has been inserted"); 

con.Close(); 

我忘了什麼或者是錯誤？

Answer 1

請使用的參數是這樣的：

using (var con = new SqlConnection("Data Source=DELL-PC;Initial Catalog=sashi;Integrated Security=True")) 
{ 
    con.Open(); 
    using(var sc = connection.CreateCommand()) 
    { 
     sc.CommandText = "INSERT INTO Login VALUES(@uid,@pass,@qun,@ans)"; 

     sc.Parameters.Add(new SqlParameter("@uid", textBoxUID.Text)); 
     sc.Parameters.Add(new SqlParameter("@pass", textBoxPWD.Text)); 
     sc.Parameters.Add(new SqlParameter("@qun", comboBoxQUN.Text)); 
     sc.Parameters.Add(new SqlParameter("@ans", textBoxANS.Text));; 

     sc.ExecuteNonQuery(); 
    } 
} 

SQL參數有助於防止SQL注入攻擊..並北京時間更容易閱讀.. 請問您的登錄表只有四列？否則，您還必須在您的插入語句中指定此項：INSERT INTO (col1, col2 ....