2011-12-19 123 views
1
Try 
    If functionmode = "ADD" Then 
     SQLStr = "INSERT INTO boatmast VALUES ('" & gBoatType & "','" & TxtBoatCode.Text & "','" & TxtBoatName.Text & "','" & Format(txtBP.Text, "##0.#0") & "','" & Format(txtBPM.Text, "##0.#0") & "','" & Format(txtLDA.Text, "##0.#0") & "','" & , 'bpk', '" & Today & "', '" & updtime & "', 'bpk', '" & Today & "', '" & updtime & "')" 
    End If 
    conn.Open() 
    SQLCmd.Connection = conn 
    SQLCmd.CommandText = SQLStr 
    SQLCmd.ExecuteNonQuery() 
    conn.Close() 


Catch ex As OdbcException 
    MsgBox(ex.ToString) 
Finally 
    conn.Close() 
End Try 
+2

此代碼是容易受到SQL注入式攻擊。 – 2011-12-19 04:53:28

+0

插入到SQL的textbox.text的值是一個*真的*壞主意。 – 2011-12-19 04:57:37

+0

我應該如何編輯它 – 2011-12-19 05:01:18

回答

4

問題是您撥打了兩次conn.Close()。在你的finally塊上保留你的關閉連接。

Try 

    If functionmode = "ADD" Then 
             //Supposed this is you columnNAmes              //Set parameters     
     SQLStr = "INSERT INTO boatmast (gBoatType,BoatCode,BoatName,BP, BPM,LDA,bpk,Today,updtime,bpk2,Today2,updtime2) VALUES (@gBoatType,@BoatCode,@BoatName,@BP, @BPM,@LDA,@bpk,@Today,@updtime,@bpk2,@Today2,@updtime2)" 

     SQLCmd.Parameters.AddWithValue("@gBoatType",gBoatType) 
     //DO OTHER STUFF TIL @updtime2    

    conn.Open() 
    SQLCmd.Connection = conn 
    SQLCmd.CommandText = SQLStr 
    SQLCmd.ExecuteNonQuery() 

    End If 
Catch ex As OdbcException 
    MsgBox(ex.ToString) 
Finally 
    If conn.State = ConnectionState.Open Then conn.Close() 
End Try 

問候

+0

當然,你的意思是刪除到「Try」塊中的那個?如果'SQLCmd.ExecuteNonQuery()'失敗,它將永遠不會關閉連接。 – 2011-12-19 04:54:33

+0

然後...把它放在最後塊..謝謝先生。我剛剛編輯了我的帖子。 – BizApps 2011-12-19 04:56:15

+0

沒有什麼變化 – 2011-12-19 04:58:10

相關問題