將一個變量添加到插入命令中的現有列名稱

Question

我有一個問題。我在堆棧和其他網站上研究過這個問題，但沒有找到答案。我想要一個插入命令，將字符串附加到現有的列名稱。我有一張表格在不同月份有多個相同的列。列的示例：name1將是1月和name2將爲2月。 地址1將用於1月和地址2將用於2月等等。唯一想到我遇到的是如何將一個變量傳遞給列的數據，我需要添加一個變量到已經存在的列名稱，所以我不會有多個插入命令。這是我的代碼。

If MonthDDL.SelectedValue <> "" Then 
     Select Case MonthDDL.SelectedValue 
      Case Is = "January" 
       Month = "0" 
       monthVar = "January" 
      Case Is = "February" 
       Month = "1" 
       monthVar = "February" 
      Case Is = "March" 
       Month = "2" 
       monthVar = "March" 
      Case Is = "April" 
       Month = "3" 
       monthVar = "April" 
      Case Is = "May" 
       Month = "4" 
       monthVar = "May" 
      Case Is = "June" 
       Month = "5" 
       monthVar = "June" 
      Case Is = "July" 
       Month = "6" 
       monthVar = "July" 
      Case Is = "August" 
       Month = "7" 
       monthVar = "August" 
      Case Is = "September" 
       Month = "8" 
       monthVar = "September" 
      Case Is = "October" 
       Month = "9" 
       monthVar = "October" 
      Case Is = "November" 
       Month = "10" 
       monthVar = "November" 
      Case Is = "December" 
       Month = "11" 
       monthVar = "December" 
       'Case Else 
     End Select 
     selDate = MonthDDL.SelectedValue 
    Else 
     lblSelect.Visible = True 
    End If 

DBCONN.Open() 
     Dim SqlUpdate = New SqlCommand("SELECT * FROM table WHERE variable = '" + Session("sessionvariable") + "'", DBCONN) 

MonthDDL.SelectedValue = monthVar And dr.HasRows = True Then 
       SqlUpdateCommd = New SqlCommand("UPDATE table SET [table].[name] '"+ Month +'" = '" & contact & "',[table].[address]'"+ Month +'" = '" + address + "' WHERE variable = '" & Session("sessionvariable") & "'", DBCONN) 
     ElseIf MonthDDL.SelectedValue = monthVar And dr.HasRows = False Then 
      SqlUpdateCommd = New SqlCommand("INSERT INTO table (name '"+ Month +'", address '"+ Month +'", variable) Values ('" + contact + "', '" + address + "', Session("sessionvariable") + "')", DBCONN) 

這是可能做到的。我甚至接近以正確的方式去做這件事。我爲短語appologize我新vb.net。我甚至不確定要搜索什麼，這可能是爲什麼我沒有真正偶然找到答案。先謝謝你！

Answer 1

Dwright是正確的。你真的不應該這樣做，因爲除其他外，如果變量是用戶可定義的，它會使你的應用程序容易受到SQL注入攻擊。重新設計你的數據庫模式會更好更簡單，因此你不需要重複這樣的列。

可是，爲什麼你的代碼失敗的可能的原因是因爲你之前和之後的變量值附加撇號，例如：

"[table].[name '" & variable & "']" 

通知書，上述說法實際上評估爲這樣的事情：

"[table].[name '1']" 

但是，你真正想要的，大概是這樣的：

"[table].[name1]" 

因此，要獲得這一點，你需要做這樣的事情：

"[table].[name" & variable & "]" 

然而，正如我所說，這不僅是一個壞主意，建立動態SQL這樣的，它也表明一個設計不當數據庫模式。