2011-12-19 119 views
1
Try 
    If functionmode = "ADD" Then 
     SQLStr = "INSERT INTO boatmast VALUES ('" & gBoatType & "','" & TxtBoatCode.Text & "','" & TxtBoatName.Text & "','" & Format(txtBP.Text, "##0.#0") & "','" & Format(txtBPM.Text, "##0.#0") & "','" & Format(txtLDA.Text, "##0.#0") & "','" & , 'bpk', '" & Today & "', '" & updtime & "', 'bpk', '" & Today & "', '" & updtime & "')" 
    End If 
    conn.Open() 
    SQLCmd.Connection = conn 
    SQLCmd.CommandText = SQLStr 
    SQLCmd.ExecuteNonQuery() 
    conn.Close() 


Catch ex As OdbcException 
    MsgBox(ex.ToString) 
Finally 
    conn.Close() 
End Try 
+2

此代码是容易受到SQL注入式攻击。 – 2011-12-19 04:53:28

+0

插入到SQL的textbox.text的值是一个*真的*坏主意。 – 2011-12-19 04:57:37

+0

我应该如何编辑它 – 2011-12-19 05:01:18

回答

4

问题是您拨打了两次conn.Close()。在你的finally块上保留你的关闭连接。

Try 

    If functionmode = "ADD" Then 
             //Supposed this is you columnNAmes              //Set parameters     
     SQLStr = "INSERT INTO boatmast (gBoatType,BoatCode,BoatName,BP, BPM,LDA,bpk,Today,updtime,bpk2,Today2,updtime2) VALUES (@gBoatType,@BoatCode,@BoatName,@BP, @BPM,@LDA,@bpk,@Today,@updtime,@bpk2,@Today2,@updtime2)" 

     SQLCmd.Parameters.AddWithValue("@gBoatType",gBoatType) 
     //DO OTHER STUFF TIL @updtime2    

    conn.Open() 
    SQLCmd.Connection = conn 
    SQLCmd.CommandText = SQLStr 
    SQLCmd.ExecuteNonQuery() 

    End If 
Catch ex As OdbcException 
    MsgBox(ex.ToString) 
Finally 
    If conn.State = ConnectionState.Open Then conn.Close() 
End Try 

问候

+0

当然,你的意思是删除到“Try”块中的那个?如果'SQLCmd.ExecuteNonQuery()'失败,它将永远不会关闭连接。 – 2011-12-19 04:54:33

+0

然后...把它放在最后块..谢谢先生。我刚刚编辑了我的帖子。 – BizApps 2011-12-19 04:56:15

+0

没有什么变化 – 2011-12-19 04:58:10

相关问题