代码之家 › 专栏 › 技术社区 › Jawad Javaid

sqlite3查询c中出现异常#

sqlite3 c#

0

Jawad Javaid · 技术社区 · 7 年前

下面是我将数据插入sqlite3数据库的代码,表名和查询似乎是正确的,但每当我插入数据时就会出现异常。

Image of exception

        query = "INSERT INTO Order (Name, Quantity, SUPrice, Desc, Total, Paid, Remain) VALUES ( '" + orderDto.Name + "', '" + orderDto.Quantity + "', '" + orderDto.SUPrice + "', '" + orderDto.Description + "', '" + orderDto.Total + "', '" + orderDto.Paid + "', '" + orderDto.Remaining  + "')";
        connection.Open();
        command = new SQLiteCommand(query, connection);
        command.ExecuteNonQuery();
        connection.Close();

2 回复 | 直到 7 年前

1

2

D-Shih 7 年前

你可以试着逃跑 order 带双引号 " ,因为是关键字。

SQL-injection .

我将使用参数而不是connectesql字符串。

query = "INSERT INTO \"Order\" (Name, Quantity, SUPrice, Desc, Total, Paid, Remain) VALUES (@Name,@Quantity,@SUPrice,@Description,@Total,@Paid,@Remain)"
connection.Open();
command = new SQLiteCommand(query, connection);
command.Parameters.Add(new SQLiteParameter("@Name", orderDto.Name);
command.Parameters.Add(new SQLiteParameter("@Quantity", orderDto.Quantity));
command.Parameters.Add(new SQLiteParameter("@SUPrice" , orderDto.SUPrice));
command.Parameters.Add(new SQLiteParameter("@Description" , orderDto.Description));
command.Parameters.Add(new SQLiteParameter("@Total", orderDto.Total));
command.Parameters.Add(new SQLiteParameter("@Paid" , orderDto.Paid));
command.Parameters.Add(new SQLiteParameter("@Remain" , orderDto.Remaining));
command.ExecuteNonQuery();
connection.Close();

2

0

John112358 7 年前

我建议对DB查询使用string.Format,这样就不那么麻烦了。

query = string.Format("INSERT INTO Order (Name, Quantity, SUPrice, Desc, Total, Paid, Remain) VALUES ( '{0}', '{1}', '{2}', '{3}', '{3}', '{4}', '{5}')", orderDto.Name, orderDto.Quantity, orderDto.SUPrice, orderDto.Description, orderDto.Total, orderDto.Paid, orderDto.Remaining);

http://sqlitebrowser.org/