提问人:Newbster 提问时间:2/24/2023 最后编辑:Joel CoehoornNewbster 更新时间:2/25/2023 访问量:93
为什么我不能将我的值上传到数据库的表中?
Why can't I upload my values into my table in my database?
问:
因此,我一直在使用 vb.net 使用Windows表单和mySQL为我的数据库做一个员工考勤管理系统。我成功地将一名员工插入到我的数据库中,但似乎无法将他的时间签入我的数据库。我的数据库中有两个表(tbl_attendance 和 tbl_employee),我已成功在员工表中插入数据,但未在考勤表中插入数据。我真的可以使用全新的眼光,因为我长期以来一直在寻找我的错误并崩溃了,现在我在这里哈哈。这是我的代码:
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
Try
If txtEmployeeID.Text = "" Then
MessageBox.Show("Please enter Employee ID", "Warning", MessageBoxButtons.OK, MessageBoxIcon.Warning)
Else
reloadtext("SELECT * FROM tbl_employees WHERE EMPLOYEEID='" & txtEmployeeID.Text & "'")
If dt.Rows.Count > 0 Then
reloadtext("SELECT * FROM tbl_attendance WHERE EMPLOYEEID='" & txtEmployeeID.Text & "' AND LOGDATE='" & lblDate.Text & "' AND AM_STATUS='Time In' AND PM_STATUS='Time Out'")
If dt.Rows.Count > 0 Then
MessageBox.Show("You already have an attendance for today", "Reminder", MessageBoxButtons.OK, MessageBoxIcon.Information)
Else
reloadtext("SELECT * FROM tbl_attendance WHERE EMPLOYEEID ='" & txtEmployeeID.Text & "' AND LOGDATE='" & lblDate.Text & "' AND AM_STATUS ='Time In'")
If dt.Rows.Count > 0 Then
updatelog("UPDATE tbl_attendance SET TIMEOUT='" & TimeOfDay & "', PM_STATUS='Time Out' WHERE EMPLOYEEID='" & txtEmployeeID.Text & "' AND LOGDATE='" & lblDate.Text & "'")
MessageBox.Show("Successfully Timed out", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
Else
createlog("INSERT INTO tbl_attendance(EMPLOYEEID,LOGDATE,TIMEIN,AM_STATUS)VALUES('" & txtEmployeeID.Text & "','" & lblDate.Text & "','" & TimeOfDay & "','Time In')")
MessageBox.Show("Successfully Timed in", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
End If
End If
Else
MessageBox.Show("Employee ID not found", "Not found", MessageBoxButtons.OK, MessageBoxIcon.Asterisk)
End If
End If
Catch ex As Exception
End Try
End Sub
我的第 18 行有问题
[这是我的功能和联系。
Imports MySql.Data.MySqlClient
Module CRUDConnection
Public result As String
Public cmd As New MySqlCommand
Public da As New MySqlDataAdapter
Public dt As New DataTable
Public ds As New DataSet
Public Sub create(ByVal sql As String)
Try
conn.Open()
With cmd
.Connection = conn
.CommandText = sql
result = cmd.ExecuteNonQuery
If result = 0 Then
MessageBox.Show("Data failed to insert.", "Error", MessageBoxButtons.OK, MessageBoxIcon.Warning)
Else
MessageBox.Show("Data successfully inserted.", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
End If
End With
Catch ex As Exception
Finally
conn.Close()
End Try
End Sub
Public Sub reload(ByVal sql As String, ByVal DTG As Object)
Try
conn.Open()
dt = New DataTable
With cmd
.Connection = conn
.CommandText = sql
End With
da.SelectCommand = cmd
da.Fill(dt)
DTG.DataSource = dt
Catch ex As Exception
Finally
conn.Close()
da.Dispose()
End Try
End Sub
Public Sub reloadtext(ByVal sql As String)
Try
conn.Open()
With cmd
.Connection = conn
.CommandText = sql
End With
dt = New DataTable
da = New MySqlDataAdapter(sql, conn)
da.Fill(dt)
Catch ex As Exception
Finally
conn.Close()
da.Dispose()
End Try
End Sub
Public Sub createlog(ByVal sql As String)
Try
conn.Open()
With cmd
.Connection = conn
.CommandText = sql
result = cmd.ExecuteNonQuery
End With
Catch ex As Exception
Finally
conn.Close()
End Try
End Sub
Public Sub updatelog(ByVal sql As String)
Try
conn.Open()
With cmd
.Connection = conn
.CommandText = sql
result = cmd.ExecuteNonQuery
End With
Catch ex As Exception
Finally
conn.Close()
End Try
End Sub
End Module
似乎无法将值插入到我的tbl_attendance
我不知道该怎么办了。我似乎找不到那个逗号。提前致谢!
答:
我似乎找不到那个逗号。
它可能来自您的数据。如果您有如下查询:
"INSERT INTO NAMES (LastName, FirstName) VALUES ('" + TextBox1.Text + "', '" + TextBox2.Text "')"
文本框的值如下所示:
O'Brien Patty
你最终会得到这样的 SQL:
INSERT INTO NAMES (LastName, FirstName) VALUES ('O'Brien', 'Patty')
突然间,姓氏中多余的字符将整个查询抛出。错误消息将抱怨文本后缺少逗号。'
'O'
更糟糕的是,攻击者可以利用这种问题对你的数据库做非常糟糕的事情......有效地运行他们想要的任何任意 SQL。一年后,你发现你在六个月前被黑客入侵,攻击者在暗网上出售你的数据之前,会持有你的数据以勒索赎金。
有几种方法可以解决这个问题,但其中一些是 BAD:它们只会将问题推向一个新的水平。更糟糕的是,它们可能看起来有效,但仍然给你留下了微妙的开口。
正确的解决方案涉及称为参数化查询的内容。不幸的是,使用它们意味着您需要回到模块的绘图板并重新思考它是如何工作的。CRUDConnection
简而言之,此模块不应公开运行任意 SQL 的公共方法。相反,要运行的每个查询都将获得自己的方法,并为输入提供强类型函数参数。
我们最终得到了一个更像这样的东西,向你展示一种方法可能是什么样子的
Module DB
' Note this is PRIVATE!
' Also note we only keep the string, and not the connection
' More info on why: https://softwareengineering.stackexchange.com/a/398790/8057
Private connectionString As String = " connection string here "
Public Sub ClockIn(EmployeeID As Integer, ClockTime As DateTime)
Dim SQL As String = "INSERT INTO tbl_attendance(EMPLOYEEID,LOGDATE,TIMEIN,AM_STATUS)VALUES(@EmployeeID,@LogDate,@TimeOfDay,'Time In')"
Using cn As New MySqlConnection(connectionString),
cmd As New MySqlCommand(SQL, cn)
cmd.Parameters.AddWithValue("@EmployeeID", EmployeeID)
cmd.Parameters.AddWithValue("@LogDate", ClockTime.Date)
cmd.Parameters.AddWithValue("@TimeOfDay", ClockTime.ToString("HH:mm:ss"))
cn.Open()
cmd.ExecuteNonQuery()
End Using
End Sub
' Note this is also PRIVATE!
' It exists to make it easier to write the other methods in the module
Private Function GetRecords(SQL As String, addParams As Func(Of MySqlParameterCollection)) As DataTable
Dim result As New DataTable
Using cn As New MySqlConnection(connectionString), _
da As New MySqlDataAdapter(SQL, cn)
If addParams IsNot Nothing Then
addParams(da.SelectCommand.Parameters)
End If
da.Fill(result)
End Using
Return result
End Function
End Module
注意:我能够对方法中的字符串使用基本文字,但其他一切都是查询参数。你需要每个查询都有自己的方法,就像这样。Time In
ClockIn()
评论
Try
Catch
CRUDConnection