update 数据库修改语句引号问题

[海盗色色]

="Update Yq Set
yqName='"+ yiqimingcheng.Text +"',(这里的 " ' 单双引号怎么加？）
yqleibieId = int.Parse(yiqileibie.SelectedValue),
yq.yqBianhao = yiqibianhao.Text.Trim(),
yqGuige = guigexinghao.Text.Trim(),
yqFromc = shengchanchangjia.Text.Trim(),
yqFrom = chandi.Text.Trim(),
yqTimeg = DateTime.Parse(gouzhiriqi.Text.Trim()),
yqYuanzhi = float.Parse(yuanzhi.Text.Trim()),
yqZhuangkuang = yiqizhuangkuang.Text.Trim(),
yqDanwei = suozaidanwei.Text.Trim(),
yqShiyanshi = suozaishiyanshi.Text.Trim(),
yqDidian = cunfangdidian.Text.Trim(),
yqLname = lianxiren.Text.Trim(),
yqDianhua = lianxidianhua.Text.Trim(),
yqEmail = email.Text.Trim(),
yqZhibiao = jishuzhibiao.Text.Trim(),
yqTese = tesegongneng.Text.Trim(),
yqYongtu = zhuyaoyongtu.Text.Trim(),
yqFuwu = fuwulingyu.Text.Trim(),
yqFujian = fujian.Text.Trim(),
yqYaoqiu = yangpinyaoqiu.Text.Trim(),
yqShoufei = shoufeibiaozhun.Text.Trim(),
yqTimek = kaifangshijian.Text.Trim(),
yqGongxiang = gongxiangjibie.Text.Trim(),
yqBeizhu = beizhu.Text.Trim(),
imgUrl =pictureName
还有后面不同类型的，引号都是怎么加的？

[namhyuk]

建议用[@变量名]这样的占位符.

SqlCommand cmd = new SqlCommand();
cmd.CommandText="Update Yq Set yqName=@yqName yqleibieId=@yqleibieId ..."
cmd.Parameters.AddWithValue("@yqName", yiqimingcheng.Text);
cmd.Parameters.AddWithValue("@yqleibieId", int.Parse(yiqileibie.SelectedValue));
...

[PandaIT]

同样你可以用

基本在开发过程中不要使用使用拼接sql到时候出错不方便！

用LS的那种方法！

要么就用{0},{1}这样的方式去写！

[海盗色色]

[Quote=引用 2 楼 zhoukang0916 的回复:]
同样你可以用

基本在开发过程中不要使用使用拼接sql到时候出错不方便！

用LS的那种方法！

要么就用{0},{1}这样的方式去写！
[/Quote]
不懂 请详解

[ivws_19]

你现在要在.net中写sql,所以变量需要用""括起来,如果非数字类型的字段,sql中需要用''括起来,譬如你的第一个变量:
"Update Yq Set yqName='"+ yiqimingcheng.Text +"',
yqleibieId 这个应该是int类型,那就直接用"",
yqleibieId = "+int.Parse(yiqileibie.SelectedValue)+",
当然,最好还是用parameter的形式传进去

[alan0128]

最古老的方式就是这样的。

Update Yq Set yqName='"+ yiqimingcheng.Text +"'， 

你的那个是对的，这样就都要采用这种格式，.Trim()这个就可以不要了。这种是超不安全，建议采用传参的方式。

[wuyq11]

这只字符串使用StringBuilder sb=new StringBuilder();
sv.Append("Update Yq Set yqName='"+ yiqimingcheng.Text +"',");
或使用参数 SqlParameter[] param
public static string GetHtmlEditReplace(string str)
{
return str.Replace("'", "''").Replace(" ", " ").Replace(",", "，").Replace("%", "％").Replace("script", "").Replace(".js", "");
}
或用Regex.Replace替换

[bj_kevin51]

  ="Update Yq Set 
                "yqName='"+ yiqimingcheng.Text +"'," +
                  "yqleibieId = '"+int.Parse(yiqileibie.SelectedValue)+"', " + 
                "yq.yqBianhao = '"+yiqibianhao.Text.Trim()+"', " +
                "yqGuige = '"+guigexinghao.Text.Trim()+"', " +
                "yqFromc = '"+shengchanchangjia.Text.Trim()+"', " +
                "yqFrom = '"+chandi.Text.Trim()+"', " +
                "yqTimeg = '"+DateTime.Parse(gouzhiriqi.Text.Trim())+"', " +
                "yqYuanzhi = '"+float.Parse(yuanzhi.Text.Trim())+"'," + 
                "yqZhuangkuang = '"+yiqizhuangkuang.Text.Trim()+"', " +
                "yqDanwei = '"+suozaidanwei.Text.Trim()+"', " +
                "yqShiyanshi = '"+suozaishiyanshi.Text.Trim()+"', " +
                "yqDidian = '"+cunfangdidian.Text.Trim()+"'," + 
                "yqLname = '"+lianxiren.Text.Trim()+"'," + 
                "yqDianhua = '"+lianxidianhua.Text.Trim()+"', " +
                "yqEmail = '"+email.Text.Trim()+"', " +
                "yqZhibiao = '"+jishuzhibiao.Text.Trim()+"', " +
                "yqTese = '"+tesegongneng.Text.Trim()+"'," + 
                "yqYongtu = '"+zhuyaoyongtu.Text.Trim()+"', " +
                "yqFuwu = '"+fuwulingyu.Text.Trim()+"', " +
                "yqFujian = '"+fujian.Text.Trim()+"', " +
                "yqYaoqiu = '"+yangpinyaoqiu.Text.Trim()+"', " +
                "yqShoufei = '"+shoufeibiaozhun.Text.Trim()+"', " +
                "yqTimek = '"+kaifangshijian.Text.Trim()+"', " +
                "yqGongxiang = '"+gongxiangjibie.Text.Trim()+"', " +
                "yqBeizhu = '"+beizhu.Text.Trim()+"', " +
                "imgUrl ='"+pictureName+"' ";

直接复制吧

[海盗色色]

"Update Yq Set
"yqName='"+ yiqimingcheng.Text +"'," +
"yqleibieId = '"+int.Parse(yiqileibie.SelectedValue)+"', " +
"yq.yqBianhao = '"+yiqibianhao.Text.Trim()+"', " +
"yqGuige = '"+guigexinghao.Text.Trim()+"', " +
"yqFromc = '"+shengchanchangjia.Text.Trim()+"', " +
"yqFrom = '"+chandi.Text.Trim()+"', " +
"yqTimeg = '"+DateTime.Parse(gouzhiriqi.Text.Trim())+"', " +
"yqYuanzhi = '"+float.Parse(yuanzhi.Text.Trim())+"'," +
"yqZhuangkuang = '"+yiqizhuangkuang.Text.Trim()+"', " +
"yqDanwei = '"+suozaidanwei.Text.Trim()+"', " +
"yqShiyanshi = '"+suozaishiyanshi.Text.Trim()+"', " +
"yqDidian = '"+cunfangdidian.Text.Trim()+"'," +
"yqLname = '"+lianxiren.Text.Trim()+"'," +
"yqDianhua = '"+lianxidianhua.Text.Trim()+"', " +
"yqEmail = '"+email.Text.Trim()+"', " +
"yqZhibiao = '"+jishuzhibiao.Text.Trim()+"', " +
"yqTese = '"+tesegongneng.Text.Trim()+"'," +
"yqYongtu = '"+zhuyaoyongtu.Text.Trim()+"', " +
"yqFuwu = '"+fuwulingyu.Text.Trim()+"', " +
"yqFujian = '"+fujian.Text.Trim()+"', " +
"yqYaoqiu = '"+yangpinyaoqiu.Text.Trim()+"', " +
"yqShoufei = '"+shoufeibiaozhun.Text.Trim()+"', " +
"yqTimek = '"+kaifangshijian.Text.Trim()+"', " +
"yqGongxiang = '"+gongxiangjibie.Text.Trim()+"', " +
"yqBeizhu = '"+beizhu.Text.Trim()+"', " +
"imgUrl ='"+pictureName+"'
+ where yqId =" + Request.QueryString["_yqid"],conn);
为什么这样提示第一行和最后一行 常量中有换行符 的错误？
还有yqId=后这个分号是不是放这里啊

[ivws_19]

"Update Yq Set "+

"imgUrl ='"+pictureName+"' where yqId =" + Request.QueryString["_yqid"],conn);
改成这样 = =

[lingxizhixia]

给你看看下面的代码吧
comdstr = "Insert Into course Values('";
comdstr += textBoxcourse_id.Text.Trim() + "','";
comdstr += textBoxcourse_caption.Text.Trim() + "','";
comdstr += textBoxcourse_classroom.Text.Trim() + "','";
comdstr += textBoxcourse_totaltime.Text.Trim() + "','";
comdstr += textBoxcourse_credit.Text.Trim() + "','";
comdstr += textBoxcourse_term.Text.Trim() + "','";
comdstr += comboBoxteacher_id.Text.Trim() + "','";
comdstr += textBoxcourse_remark.Text.Trim() + "')";

不过建议使用下面的方法 以保证数据的安全性
SqlConnection conn=new SqlConnection ();
conn.ConnectionString=connstr ;
SqlCommand comd=new SqlCommand ();
comd.CommandType =CommandType .Text ;
comd.CommandText =comdstr ;
comd.Connection =conn ;
SqlParameter[] pars=new SqlParameter[]{
new SqlParameter("@id",textBoxlogin_id .Text .Trim ()),
new SqlParameter("@password",textBoxlogin_password .Text .Trim ()),
new SqlParameter("@status",comboBoxstatus .Text .Trim ())
};
foreach(SqlParameter p in pars)
comd.Parameters .Add(p);

[ivws_19]

建议使用stringbuilder,如6楼所示

[程序漫步]

用 变量 参数化 就可以了