sqlString += SqlString.GetQuotedString(zhuyuanModel.getName()) + ",";

Question

   

我想在数据库中的t_zhuyuan这个表中多加入一个minzu字段，就会报错

请大神帮我一下，

 public bool AddZhuyuanInfo(ZhuyuanModel zhuyuanModel)
        {
            string sqlString = "insert into [t_zhuyuan] (name,sex,age,roomNo,arriveTime,isLeave,leaveTime,money,checkinOperator,checkoutOperator,minzu) values ";
            sqlString += SqlString.GetQuotedString(zhuyuanModel.getName()) + ",";
            sqlString += SqlString.GetQuotedString(zhuyuanModel.getSex()) + ",";
            sqlString += zhuyuanModel.getAge() + ",";

            //sqlString +=sqlString.ge

            sqlString += SqlString.GetQuotedString(zhuyuanModel.getRoomNo()) + ",";
            sqlString += "'" + zhuyuanModel.getArriveTime() + "',";
            sqlString += zhuyuanModel.getIsLeave() + ",";
            sqlString += "'" + zhuyuanModel.getLeaveTime() + "',";
            sqlString += zhuyuanModel.getMoney() + ",";
            sqlString += SqlString.GetQuotedString(zhuyuanModel.getCheckinOperator()) + ",";
            sqlString += SqlString.GetQuotedString(zhuyuanModel.getCheckoutOperator()) + ")";

            DataBase db = new DataBase();
            if (db.InsertOrUpdate(sqlString) < 0)
            {
                this.errMessage = "登记预约信息发生了错误！";
                return false;
            }
            return true;
        }

Answer 1

你好 新的开始2016，

根据我的经验，十有八九是最后拼接出来的SQL语句有问题，请用调试功能查看一下runtime的时候最后形成了什么INSERT，然后copy到SQL Server里面运行一下就知道错误在哪里了。

t_zhuyuan这个表添加完minzu后有11个字段，但是你在sqlString拼接的时候只用了10个字段，请把minzu字段的内容添加到sqlString字符串就可以了。

希望能帮到你。

---

We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click HERE to participate the survey.

Answer 2

你数一下，字段有11个，values只有10个，你对minzu的赋值呢

---

http://feiyun0112.cnblogs.com/

Answer 3

不推荐用拼凑字符串的方法(还需要处理SQL注入的问题，比如字符串值里面包含一个单引号)，推荐用参数的方式

参考例子:

SqlParameter sp = new SqlParameter("@name", "James");

command.Parameters.Add(sp);