1

Хочу ввести в базу данных значения с клавиатуры

   Flight flight = new Flight();
        SqlCommand addflight = new SqlCommand();
        addflight.Connection =Sqlcon;
        Console.WriteLine("Enter Arrival Date");
        flight.Arrival = EnterData();
        Console.WriteLine("Enter Departure Date");
        flight.Departure = EnterData();
        Console.Write("Enter Flight number=");
        flight.Flight_Number = Convert.ToString(Console.ReadLine());
        Console.Write("Enter City of arrival=");
        flight.City_of_arrival = Convert.ToString(Console.ReadLine());
        Console.Write("Enter City of departure=");
        flight.City_of_Departure = Convert.ToString(Console.ReadLine());
        Console.Write("Enter Terminal=");
        flight.Terminal = Convert.ToString(Console.ReadLine());
        Console.Write("Enter Flight status=");
        flight.Flight_Status = Convert.ToString(Console.ReadLine());
        Console.Write("Enter Gate=");
        flight.Gate= Convert.ToString(Console.ReadLine());
       // addflight.CommandText = "INSERT INTO Flights(Arrival,Departure,Flight_Number,City_of_arrival,City_of_departure,Terminal,Flight_Status,Gate,ID) VALUES (2007-05-08 12:35:29.123,2007-05-08 12:35:29.123,s,s,s,s,s,s,s,1)";
       addflight.CommandText = "INSERT INTO Flights(Arrival,Departure,Flight_Number,City_of_arrival,City_of_departure,Terminal,Flight_Status,Gate,ID) VALUES("+
            "20120618 10:34:09 AM" + ","+ "20120618 10:34:09 AM" + ","+flight.Flight_Number+","+flight.City_of_arrival+","+flight.City_of_Departure
            +","+flight.Terminal+","+flight.Flight_Status+","+flight.Gate+","+ID+")";
        ID++;
        try
        {
            addflight.ExecuteNonQuery();
        }
        catch(Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }

При использовании команды INSERT INTO выводиться сообщение о Exception на экран.Incorrect Syntax near 10.Что в строке CommandText не так? Может есть более правильный способ это сделать?

1 ответ 1

1

Не собирайте CommandText через +, используйте параметры:

addflight.CommandText = "INSERT INTO Flights(Arrival,Departure,...,ID) VALUES(@Arrival, @Departure .... )";
addflight.Parameters.AddWithValue("@Arrival", flight.Arrival);
addflight.Parameters.AddWithValue("@Departure", flight.Departure);
//....

И не будет у вас ошибок с парсингом дат и прочих SQL иньекций.

Ваш ответ

By clicking “Отправить ответ”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Всё ещё ищете ответ? Посмотрите другие вопросы с метками или задайте свой вопрос.