我無法在我的acces數據庫中插入值

Question

這是我在VB.NET中的代碼。

我的try catch表示指令INSERT INTO中有語法錯誤。我不知道我的INSERT發生了什麼。我搜索了一個多小時的錯誤...我不是VB.NET的專家，我在C＃中更好，但是我仍然需要在VB中執行此操作...

感謝您幫助我！

Sub InsertRecord() 
Dim conClasf As OleDbConnection 
Dim cmdClasf As New OleDbCommand 
Dim strClasf As String 
Dim strSQL As String 
Dim intRowsAff As Integer 

lblErrMsg.Text = "" 
lblRecsAff.Text = "" 
    strClasf = "Provider=Microsoft.Jet.OLEDB.4.0;" & _ 
     "Data Source=" & _ 
     server.mappath("BecsEtMuseaux.mdb") & ";" 
conClasf = New OleDbConnection(strClasf) 
conClasf.Open 

Randomize 
    strSQL = "INSERT INTO client (" & _ 
     "UserName, " & _ 
     "Prenom, " & _ 
     "Nom, " & _ 
     "password, " & _ 
     "mail, " & _ 
     "Addresse, " & _ 
     "Ville, " & _ 
     "PostalCode, " & _ 
     "Province, " & _ 
     "Pays, " & _ 
     "AnimalGenre, " & _ 
     "NomAnimal, " & _ 
     "Race, " & _ 
") VALUES ('" & _ 
     Replace(txtUserName.Text, "'", "''") & _ 
     "', '" & _ 
     Replace(txtPrénom.Text, "'", "''") & _ 
     "', '" & _ 
     Replace(txtNom.Text, "'", "''") & _ 
     "', '" & _ 
     Replace(txtPass.Text, "'", "''") & _ 
     "', '" & _ 
     Replace(txtMail.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtAdresse.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtVille.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtPostal.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtProvince.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtPays.Text, "'", "''") & _ 
     "', " & _ 
     Replace(rblAnimal.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtAnimal.Text, "'", "''") & _ 
     "', " & _ 
     Replace(txtRace.Text, "'", "''") 

     cmdClasf = New OleDbCommand(strSQL, conClasf) 
     Try 
     intRowsAff = cmdClasf.ExecuteNonQuery() 
     Catch ex As Exception 
     lblErrMsg.Text = ex.Message  
     End Try 
     lblRecsAff.Text = intRowsAff & " record(s) inserted" 
     conClasf.Close 
End Sub 

Answer 1

也許這會導致你的錯誤。

您可以使用參數，以避免SQL注入攻擊：

 "Race, " & _ //Race**,** try to remove , 
") 

，如果你嘗試這種

好多了。

參見：

Parameter Queries in ASP.NET with MS Access

Configuring Parameters and Parameter Data Types (ADO.NET)

Use Parameters in your sql command

希望這有助於。

Regards

Answer 2

Escape the Password field。它是Access Engine.的保留字。

strSQL = "INSERT INTO client (UserName,Prenom,Nom,[password],mail, 
      Addresse,Ville,PostalCode,Province,Pays,AnimalGenre,NomAnimal,Race) 
      VALUES 
      (@UserName,@Prenom,@Nom,@password,@mail, 
      @Addresse,@Ville,@PostalCode,@Province,@Pays, 
      @AnimalGenre,@NomAnimal,@Race)"