2014-04-06 52 views
-1

我正在用Csharp和sql。但我得到的错误为解析查询时发生错误。 [令牌行号= 1,令牌行偏移= 40,令牌出错=首先]

解析查询时出错。 [令牌行号= 1,令牌行偏移= 40,令牌错误=首页]

private void CustomerAdded(Customer c) 
    { 
     string query = string.Empty; 
     int rowsAffected = 0; 
     try 
     { 

      if (connection.State != ConnectionState.Open) 
      { 
       connection.Open(); 
      } 

query = string.Format("INSERT INTO CustomerRecord(CustomerId, First Name, Surname, PhoneNumber, City,Country, Account Manager) VALUES ({0},'{1}','{2}','{3}','{4}','{5}','{6}')",c.CustomerId,c.FirstName,c.Surname,c.PhoneNumber,c.City,c.Country,c.AccountManager); 



SqlCeCommand command = new SqlCeCommand(query, connection); 

    rowsAffected = command.ExecuteNonQuery();(this is were the error say line 162) 

     } 
     catch (Exception ex) 
     { 
      MessageBox.Show("Error " + ex.ToString()); 
     } 
     finally 
     { 
      connection.Close(); 
     } 
     GetCustomers(); 
     bs.ResetBindings(false); 
+1

您有一个SQL注入漏洞。 – SLaks

回答

1

如果您在列名(S)有空白你需要使用方brackets.Use [First Name]而不是First Name[Account Manager]而不是Account Manager。如果要为所有列插入值,则不需要指定列名称。

另外您应该考虑使用parameterized queries来防止SQL Injection攻击。

+0

非常感谢Selma22,在将[First Name]替换为First Name和[Account Manager]之后,正在workinggggggggggggg上。 – user3502556

相关问题