Update語句在MySQL中使用C＃

Question

我一直在建立一個小的庫存系統爲我的工作場所，並無意中發現，我似乎無法修復

private void Update(string num,string name, string quant, string location, string category, string numquery) 
    { 
     // "UPDATE Inventory SET Inventorynumber='"+ num +"',Inventory_Name='"+name+"', Quantity ='"+ quant+"',Location ='"+ location+"' Category ='"+ category+"' WHERE Inventorynumber ='"+ numquery +"';"; 
     string query = "UPDATE Inventory SET Inventorynumber='" + Convert.ToInt16(num) + "',Inventory_Name='" + name + "', Quantity ='" + quant + "',Location ='" + location + "' Category ='" + category + "' WHERE Inventorynumber ='" + Convert.ToInt16(numquery) + "'"; 
     if (this.OpenConnection() == true) 
     { 
      MySqlCommand cmd = new MySqlCommand(); 
      cmd.CommandText = query; 
      cmd.Connection = serverconnection; 
      cmd.ExecuteNonQuery(); 
      this.CloseConnection(); 
      Bind(); 
     } 
    } 

我不知道是什麼改變這裏的一個錯誤。 任何幫助，將不勝感激。

Answer 1

問題：您在查詢中輸入location後缺少comma。
解決方案：您需要使用comma單獨使用parameters。

建議：使用parameterised queries避免Sql Injection Attacks

試試這個：

private void Update(string num,string name, string quant, string location, string category, string numquery) 
{ 
    // "UPDATE Inventory SET Inventorynumber='"+ num +"',Inventory_Name='"+name+"', Quantity ='"+ quant+"',Location ='"+ location+"' Category ='"+ category+"' WHERE Inventorynumber ='"+ numquery +"';"; 
    string query = "UPDATE Inventory SET Inventorynumber=@Inventorynumber,Inventory_Name=@Inventory_Name, Quantity =@Quantity ,Location =@Location,Category =@Category WHERE Inventorynumber =@Inventorynumber"; 
    if (this.OpenConnection() == true) 
    { 
     MySqlCommand cmd = new MySqlCommand(); 
     cmd.CommandText = query; 
     cmd.Parameters.AddWithValue("@Inventorynumber",Convert.ToInt16(num)); 
     cmd.Parameters.AddWithValue("@Inventory_Name",name); 
     cmd.Parameters.AddWithValue("@Quantity",quant); 
     cmd.Parameters.AddWithValue("@Location",location); 
     cmd.Parameters.AddWithValue("@Category",category); 
     cmd.Parameters.AddWithValue("@Inventorynumber",Convert.ToInt16(numquery)); 
     cmd.Connection = serverconnection; 
     cmd.ExecuteNonQuery(); 
     this.CloseConnection(); 
     Bind(); 
    } 
} 

Answer 2

試着在整數去除'單引號？

Answer 3

你缺少位置和類別之間的逗號。你聽說過這個萬次befor我知道，但它確實好得多使用預處理語句，所以你不必照顧這樣的事情的，你的代碼是更具可讀性。

Answer 4

你錯過了查詢

Location ='" + location + "', Category ='" + category + "' 
// see the `,` between Location and Category 

Answer 5

你錯過了逗號（，）逗號：

string query = "UPDATE Inventory SET Inventorynumber='" + Convert.ToInt16(num) + "',Inventory_Name='" + name + "', Quantity ='" + quant + "',Location ='" + location + "' Category ='" + category + "' WHERE Inventorynumber ='" + Convert.ToInt16(numquery) + "'"; 

讓它爲：

string query = "UPDATE Inventory SET Inventorynumber='" + Convert.ToInt16(num) + "',Inventory_Name='" + name + "', Quantity ='" + quant + "',Location ='" + location + "', Category ='" + category + "' WHERE Inventorynumber ='" + Convert.ToInt16(numquery) + "'"; 

Answer 6

是錯誤是在失蹤逗號，但這是所有混亂的字符串連接的結果，總是以微妙的語法錯誤結束。
你爲什麼不使用參數化查詢？這是簡單得多寫，你避免類似的和（更重要的）解析錯誤您避免SQL注入

private void Update(string num,string name, string quant, string location, string category, string numquery) 
{ 
    string query = "UPDATE Inventory SET Inventorynumber=@num, Inventory_Name=@name, " + 
        "Quantity =@qty,Location =@loc, Category =@cat " + 
        "WHERE Inventorynumber =@numquery"; 
    if (this.OpenConnection() == true) 
    { 
     MySqlCommand cmd = new MySqlCommand(query, serverconnection); 
     cmd.Parameters.AddWithValue("@num", Convert.ToInt16(num)); 
     cmd.Parameters.AddWithValue("@name", name); 
     cmd.Parameters.AddWithValue("@qty", quant); 
     cmd.Parameters.AddWithValue("@loc", location); 
     cmd.Parameters.AddWithValue("@cat", category); 
     cmd.Parameters.AddWithValue("@numquery", Convert.ToInt16(numquery)); 
     cmd.ExecuteNonQuery(); 
     this.CloseConnection(); 
     Bind(); 
    } 
} 

作爲一個方面說明我對一些參數類型有些疑惑。你確定這個數量是否真的是一個字符串，正如原始價值附近的引號所暗示的那樣？ 另外，numquery和num變量是字符串類型，您嘗試將其轉換爲短整數，然後將它們放在引號內（意味着在數據庫中的字段是文本類型）。這完全沒有意義。如果數據庫需要數字，那麼不要使用引號，如果數據庫需要字符串，則不要嘗試轉換。使用參數化查詢的另一個原因是強制您反思這些問題。