如何正确使用INSERT将数据插入表中？

[JJ541149229]

代码如下：
string connString = "Data Source=.;Initial Catalog=STManagement;User ID=sa;Pwd=123456";
SqlConnection connection = new SqlConnection(connString);
connection.Open();
string sql = "insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values('this.id.Text','this.name.Text','this.pwd.Text','this.sex.Text','this.year.Text,this.month.Text,this.day.Text','this.academy.Text','this.email.Text','this.call.Text')";
SqlCommand com = new SqlCommand(sql, connection);//执行SQL语句
connection.Close();
MessageBox.Show("注册成功", "注册", MessageBoxButtons.OK, MessageBoxIcon.Information);
this.Close();

[loweek]

string sql = string.Format("insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values('{0}','{1}','this.pwd.Text','this.sex.Text','this.year.Text,this.month.Text,this.day.Text','this.academy.Text','this.email.Text','this.call.Text',this.id.text,this.name.text)"; 按这个改！@

[凡尘]

StringBuilder sql=new StringBuilder(); sql.Append("insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values('") .Append(this.id.Text) .Append("','").Append(this.name.Text) .Append(',').Append() //对应的值 .Append("')") ; SqlCommand com = new SqlCommand(sql.ToString(), connection);//执行SQL语句 //'this.name.Text'如果是控件值是不能用引号的

[蝶恋花雨]

string birthday=this.year.Text+this.month.Text+this.day.Text； values('"+this.id.Text+"','"+this.name.Text+"'','"+this.pwd.Text+"'','this.sex.Text+"'','"+birthday+"','"+this.academy.Text+"'','"+this.email.Text+"'','"+this.call.Text+"'')";

[蝶恋花雨]

另外写参数的写法 例如 string cmdText = "insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values values(@from,@title,@content,@width,@height,@filesize,@inputby,@pdate);"; SqlParameter[] sqlparm = new SqlParameter[8]; sqlparm[0] = new SqlParameter("@from", SqlDbType.Int); sqlparm[0].Value = from; sqlparm[1] = new SqlParameter("@title", SqlDbType.VarChar, 5000); sqlparm[1].Value = title;

[稻庄]

string connString = "Data Source=.;Initial Catalog=STManagement;User ID=sa;Pwd=123456";
SqlConnection connection = new SqlConnection(connString);
connection.Open();
string sql = "insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values('"+this.id.Text+"','"+this.name.Text+"','"+this.pwd.Text+"','"+this.sex.Text+"','"+this.year.Text+"','"+this.month.Text+"','"+this.day.Text+"','"+this.academy.Text+"','"+this.email.Text+"','"+this.call.Text+"')";
SqlCommand com = new SqlCommand(sql, connection);//执行SQL语句
connection.Close();
MessageBox.Show("注册成功", "注册", MessageBoxButtons.OK, MessageBoxIcon.Information);
this.Close(); 

-------------------不就是简单的""里添加变量么？

[你们是不是在找BUG]

引用 4 楼 kongwei521 的回复:

另外写参数的写法 例如 string cmdText = "insert into STManagement BasinMessage(学号,姓名,密码,性别,生日,学院,邮箱,联系方式)values values(@from,@title,@content,@width,@height,@filesize,@inputby,@pdate);"; ……

使用这种方式，不要拼接字符串，SqlParameter的方式来传递参数