System.Data.dll中出现'System.Data.OleDb.OleDbException'附加信息：不是有效的文件名

Question

这是我的代码。
文件名是正确的，我不知道是什么问题。我已经检查过了，我找不到原因，如果有人能帮助我，这将是真棒

using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Data; 
using System.Drawing; 
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 
using System.Windows.Forms; 
using System.Data.OleDb; 

namespace Car 
{ 
    public partial class AddCar : Form 
    { 
     OleDbConnection cnnOLEDB = new OleDbConnection(); 
     OleDbCommand cmdInsert = new OleDbCommand(); 
     public AddCar() 
     { 
      InitializeComponent(); 
     } 

     private void AddCar_Load(object sender, EventArgs e) 
     { // i use access 2013 
     //the address of file is exactly the same as here 
      cnnOLEDB.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data  Source=‪C:\database\LOGIN.accdb;"; 
      cnnOLEDB.Open(); 
      //the error exactly shows here 
     } 

     private void InstButton_Click(object sender, EventArgs e) 
     { 
      if(txtFullName.Text != "" && txtPIC.Text != "" && txtEmail.Text != "" && txtHP.Text != "" && txtAddress.Text != "" && txtAmount.Text != "" && txtDOR.Text != "" && txtDORE.Text != "") 
      { 
       cmdInsert.CommandText = "INSERT INTO MemN(FullName, PICNO, Email, HP, Address, Amount, DOR, DORE) VALUES (\'" + txtFullName.Text + "\' , \'" + txtPIC.Text + "\' , \'" + txtEmail.Text + "\' , " + txtHP.Text + " , \'" + txtAddress.Text + "\' , \'" + txtAmount.Text + "\' , \'" + txtDOR.Text + "\' , \'" + txtDORE.Text + "\');"; 
       cmdInsert.CommandType = CommandType.Text; 
       cmdInsert.Connection = cnnOLEDB; 
       MessageBox.Show("Customer added."); 
      } 
      else 
      { 
       MessageBox.Show("Customer is not added successfully!"); 
      } 

      cmdInsert.Dispose(); 

     } 
    } 
} 

Answer 1

首先，你应该使用parameterized SQL防止sql injection。

您没有给qoutes围绕它的值HP qoutes。

cmdInsert.CommandText = "INSERT INTO MemN(FullName, PICNO, Email, HP, Address, Amount, DOR, DORE) VALUES (\'" + txtFullName.Text + "\' , \'" + txtPIC.Text + "\' , \'" + txtEmail.Text + "\' , \'" + txtHP.Text + "\' , \'" + txtAddress.Text + "\' , \'" + txtAmount.Text + "\' , \'" + txtDOR.Text + "\' , \'" + txtDORE.Text + "\');"; 

您可以使用参数化查询这样

cmdInsert.CommandText = "INSERT INTO MemN(FullName, PICNO, Email, HP, Address, Amount, DOR, DORE) VALUES (@FullName, @PICNO, @Email, @HP, @Address, @Amount, @DOR, @DORE);"; 
cmd.Parameters.AddWithValue("@FullName", txtFullName.Text); 
cmd.Parameters.AddWithValue("@PICNO", txtPIC.Text); 
cmd.Parameters.AddWithValue("@Email", txtEmail.Text); 
cmd.Parameters.AddWithValue("@HP", txtHP.Text); 
cmd.Parameters.AddWithValue("@Address", txtAddress.Text); 
cmd.Parameters.AddWithValue("@Amount", txtAmount.Text); 
cmd.Parameters.AddWithValue("@DOR", txtDOR.Text); 
cmd.Parameters.AddWithValue("@DORE", txtDORE.Text);