INSERT INTO 语句的语法错误
Posted
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了INSERT INTO 语句的语法错误相关的知识,希望对你有一定的参考价值。
我把代码放上来给大家看看,方便解决问题.
<!--#include file="../include/open.asp" -->
<%
dim userName,password,rs
userName=request.form("userName")
password=md5(request.form("password"))
for i=1 to len(userName)
us=mid(userName,i,1)
if us="'" or us="%" or us="<" or us=">" or us="&" then
response.redirect "err.asp?message=对不起,您输入的用户名包括禁用字符。"
response.end
end if
next
for i=1 to len(password)
ps=mid(password,i,1)
if ps="'" or ps="%" or ps="<" or ps=">" or ps="&" then
response.redirect "err.asp?message=对不起,您输入的密码包括禁用字符。"
response.end
end if
next
%>
<%
set rs=server.createobject("adodb.recordset")
sqlcmd="select * from webuser where userName='"&userName&"' and password='"&password&"' and is_open order by id"
rs.open sqlcmd,conn,1,1,1
'记入登录日志
ip=request.servervariables("remote_addr")
sys=request.servervariables("http_user_agent")
if rs.eof then
sqlcmd="insert into loginLog (ip,sys,userName,password)values('"&ip&"','"&sys&"','"&userName&"','"&password&"')"
conn.execute sqlcmd
conn.close
set conn=nothing
response.redirect "index.asp?message=对不起,您输入的用户名或密码有误"
else
sqlcmd="insert into loginLog (ip,sys,userName,password)values('"&ip&"','"&sys&"','"&userName&"','"&password&"')"
conn.execute sqlcmd
session("uid")=rs("id")
session("uname")=rs("userName")
session("rights")=rs("modeFlag")
session.timeout=180
uid=session("uid")
sqlcmd="update webuser set login_times=login_times+1,lastLogin=now() where id="&uid
conn.execute sqlcmd
response.redirect "../framefiles/frame.asp"
end if
rs.close
set rs=nothing
conn.close
set conn=nothing
%>
Microsoft JET Database Engine (0x80040E14)
INSERT INTO 语句的语法错误。
/hx/manage/checkuser.asp, 第 42 行
执行 INSERT INTO 语句时出现语法错误
【中文标题】执行 INSERT INTO 语句时出现语法错误【英文标题】:Syntax error when executing INSERT INTO statement 【发布时间】:2013-12-03 16:08:16 【问题描述】:我输入了正确的dataSource
,但我无法解决问题cmd.ExecuteNonQuery()
说:
INSERT INTO 语句中的语法错误。
代码:
Private Sub btnadd1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnadd1.Click
Dim cmd As New OleDb.OleDbCommand
Dim Printlist1 As New DataTable
If Not con.State = ConnectionState.Open Then
con.ConnectionString = "Provider=Microsoft.Ace.OLEDB.12.0; Data Source=c:Database11.accdb"
con.Open()
cmd.Connection = con
End If
If Me.text1.Tag & "" = "" Then
cmd.CommandText = "INSERT INTO Printlist1(StickerCode, Description, Company, Department, Location, User, SerialNumber, DatePurchased, Tagable, Quantity, Brand, Model)" & _
" VALUES(" & Me.text1.Text & ",'" & Me.text2.Text & "','" & _
Me.text3.Text & "','" & Me.text4.Text & "','" & Me.text5.Text & "','" & _
Me.text6.Text & "','" & Me.text7.Text & "','" & Me.text8.Text & "','" & _
Me.text9.Text & "','" & Me.text10.Text & "','" & Me.text11.Text & "','" & _
Me.text12.Text & "')"
cmd = New OleDbCommand(cmd.CommandText, con)
cmd.ExecuteNonQuery()
Else
cmd.CommandText = "UPDATE Printlist1 " & _
" SET StickerCode='" & Me.text1.Text & _
", Description='" & Me.text2.Text & "'" & _
", Company='" & Me.text3.Text & "'" & _
", Department='" & Me.text4.Text & "'" & _
", Location='" & Me.text5.Text & "'" & _
", User='" & Me.text6.Text & "'" & _
", SerialNumber='" & Me.text7.Text & "'" & _
", DatePurchased='" & Me.text8.Text & "'" & _
", Tagable='" & Me.text9.Text & "'" & _
", Quantity='" & Me.text10.Text & "'" & _
", Brand='" & Me.text11.Text & "'" & _
", Model='" & Me.text12.Text & "'" & _
" WHERE text1=" & Me.text1.Tag
cmd.ExecuteNonQuery()
End If
RefreshData()
Me.btnclear1.PerformClick()
con.Close()
End Sub
【问题讨论】:
请学会使用参数。 当您跟踪代码时,cmd.CommandText
属性在将其提供给OleDbCommand
之前的值是多少?另外,正如昨天有人提到的,你真的应该使用参数。
我真的不认为您必须使用SQL插入数据表,您只需使用vb net code即可
这些文本框是否包含撇号?
【参考方案1】:
使用参数化查询,如下所示:
cmd.CommandText = "INSERT INTO Printlist1(StickerCode, Description, Company, Department, Location, User, SerialNumber, DatePurchased, Tagable, Quantity, Brand, Model)" & _
" VALUES(@StickerCode, @Description, @Company, @Department, @Location, @User, @SerialNumber, @DatePurchased, @Tagable, @Quantity, @Brand, @Model)"
cmd.Parameters.AddWithValue("@StickerCode", Me.Text1.Text)
cmd.Parameters.AddWithValue("@Description", Me.Text2.Text)
cmd.Parameters.AddWithValue("@Company", Me.Text3.Text)
cmd.Parameters.AddWithValue("@Department", Me.Text4.Text)
cmd.Parameters.AddWithValue("@Location", Me.Text5.Text)
cmd.Parameters.AddWithValue("@User", Me.Text6.Text)
cmd.Parameters.AddWithValue("@SerialNumber", Me.Text7.Text)
cmd.Parameters.AddWithValue("@DatePurchased", Me.Text8.Text)
cmd.Parameters.AddWithValue("@Tagable", Me.Text9.Text)
cmd.Parameters.AddWithValue("@Quantity", Me.Text10.Text)
cmd.Parameters.AddWithValue("@Brand", Me.Text11.Text)
cmd.Parameters.AddWithValue("@Model", Me.Text12.Text)
注意:最好保持参数的顺序与查询一致,因为如果顺序改变,Microsoft Access 等数据库将无法正确执行查询。
【讨论】:
我会尝试并尝试理解参数化查询..谢谢。【参考方案2】:您的某个Me.textN.Text
值中可能包含撇号或其他一些意外字符,这些字符破坏了您的SQL 引号。解决这个问题的方法是使用参数化查询和/或存储过程。
顺便说一句,这也将保护您免受 SQL 注入攻击,该攻击利用了在客户端应用程序中将 SQL 命令组合为字符串时的相同缺点。
(注意:我假设 Me.text1.Text
是一个数字,因为 StickerCode
是一个数字。否则这就是问题,因为您没有像其他列那样引用它。)
【讨论】:
【参考方案3】:第一行缺少 '
...
"SET StickerCode='" & Me.text1.Text & "'" & _
...
【讨论】:
但这是更新命令中的错误,而不是插入命令。 @StevenDoggart 或两者兼而有之。如果StickerCode
是一个文本字段,那么 INSERT 语句中的引号也会丢失。【参考方案4】:
您的第一个值周围缺少单引号。试试
" VALUES('" & Me.text1.Text & "','" & Me.text2.Text & "','" & _
Me.text3.Text & "','" & Me.text4.Text & "','" & Me.text5.Text & "','" & _
Me.text6.Text & "','" & Me.text7.Text & "','" & Me.text8.Text & "','" & _
Me.text9.Text & "','" & Me.text10.Text & "','" & Me.text11.Text & "','" & _
Me.text12.Text & "')"
【讨论】:
这不取决于数据类型吗? 是的,它确实取决于列的数据类型。根据变量名 text1,我假设该列是字符串类型。以上是关于INSERT INTO 语句的语法错误的主要内容,如果未能解决你的问题,请参考以下文章