我很難注入sql到我的項目

我的添加語句是工作相當不錯，但當它轉向編輯數據它不會工作。我不知道我應該使用什麼正確的代碼。我真的需要你的幫助！我很難注入sql到我的項目

我的添加語句工作得很好，但是當編輯數據時它不會工作。我不知道我應該使用什麼正確的代碼。我真的需要你的幫助！

Imports System.Data.SqlClient 
Public Class Form1 
Dim connetionString As String 
Dim cnn As SqlConnection 
Dim cmd As SqlCommand 
Dim da As SqlDataAdapter 
Dim dt As DataTable 
Dim ds As DataSet 
Dim sql As String 
Private Sub btnAdd_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnAdd.Click 

      connetionString = "Data Source=xxx;Initial Catalog=xxx;User ID=xxx;Password=xxx" 
    sql = "INSERT INTO Table_Info (ID,Name) VALUES ('" & Me.txtID.Text & "','" & Me.txtName.Text & "')" 

    cnn = New SqlConnection(connetionString) 

    cnn.Open() 
    cmd = New SqlCommand(sql, cnn) 
    cmd.ExecuteNonQuery() 
    cmd.Dispose() 
    cnn.Close() 

End Sub 
Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load 
    'TODO: This line of code loads data into the 'TestDataSet.Table_Info' table. You can move, or remove it, as needed. 
    Me.Table_InfoTableAdapter.Fill(Me.TestDataSet.Table_Info) 

End Sub 
Private Sub btnEdit_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnEdit.Click 

    Dim connetionString As String 
    connetionString = "Data Source=xxx;Initial Catalog=xxx;User ID=xxx;Password=xxx" 

    cnn = New SqlConnection(connetionString) 
    sql = "insert into Table_Info (ID,Name) values('" & txtID.Text & "','" & txtName.Text & "')" 
    Try 
     cnn.Open() 
     da.InsertCommand = New SqlCommand(sql, cnn) 
     da.InsertCommand.ExecuteNonQuery() 
     MsgBox("err.discription") 
    Catch ex As Exception 
     MsgBox(ex.ToString) 
    End Try 



End Sub

末級

來源

2013-03-08 beginnerVB.Net

幾個百分點。

首先，INSERT SQL命令用於將新行插入到數據庫表中。如果您要編輯現有的行，則需要使用UPDATE命令。它看起來像UPDATE Table_Info SET Name = @name WHERE ID = @id。其次，你真的不應該像這樣構建SQL命令字符串。當你將未經驗證的用戶輸入直接傳遞到數據庫中時，你基本上已經打開了自己的SQL注入攻擊。你應該看看parametrized queries。

來源

2013-03-08 09:15:12 CadentOrange

我很難注入sql到我的項目

回答

相關問題