附近有语法错误 'S'

Question

我得到​​错误..错误：Incorrect syntax near 's'

代码：

con = new SqlConnection("Data Source=DELL-PC;Initial Catalog=sashi;Integrated Security=True"); 
con.Open(); 
SqlCommand sc = new SqlCommand("INSERT INTO Login VALUES('" + textBoxUID.Text + "','" + textBoxPWD.Text + "','" + comboBoxQUN.Text + "','" + textBoxANS.Text + "') ", con); 

sc.ExecuteNonQuery(); 
MessageBox.Show("Record has been inserted"); 

con.Close(); 

我忘了什么或者是错误？

Answer 1

请使用的参数是这样的：

using (var con = new SqlConnection("Data Source=DELL-PC;Initial Catalog=sashi;Integrated Security=True")) 
{ 
    con.Open(); 
    using(var sc = connection.CreateCommand()) 
    { 
     sc.CommandText = "INSERT INTO Login VALUES(@uid,@pass,@qun,@ans)"; 

     sc.Parameters.Add(new SqlParameter("@uid", textBoxUID.Text)); 
     sc.Parameters.Add(new SqlParameter("@pass", textBoxPWD.Text)); 
     sc.Parameters.Add(new SqlParameter("@qun", comboBoxQUN.Text)); 
     sc.Parameters.Add(new SqlParameter("@ans", textBoxANS.Text));; 

     sc.ExecuteNonQuery(); 
    } 
} 

SQL参数有助于防止SQL注入攻击..并北京时间更容易阅读.. 请问您的登录表只有四列？否则，您还必须在您的插入语句中指定此项：INSERT INTO (col1, col2 ....