如何向MySql插入C#值？

Question

我想将C# winform值插入到Mysql中。

有3列

姓名、id为TextBox文本，性别为ComboBox值

但有错误和错误消息说: MySql.Data.MySqlClient.MySqlException：‘您的SQL语法中有一个错误；请查看与您的MySQL服务器版本相对应的手册，了解要在''，')’行附近使用的正确语法。‘

我应该修复哪些代码？

using (MySqlConnection conn2 = new MySqlConnection(strconn))
        { 
            conn2.Open();
            string query = "INSERT INTO student1(name,id,gender) values ('" + name3.Text + "'," + id3.Text + "'," + gender3.SelectedValue+"');";
            MySqlCommand cmd = new MySqlCommand(query, conn2);
            cmd.ExecuteNonQuery();
        }

Answer 1

在name3.Text和id3.Text之间以及id3.Text和gender3.SelectedValue之间的连接字符串文字中缺少一个单引号

但这无关紧要。如果像这样连接用户提供的字符串，那么系统被攻破只是个时间问题。有一种更好的方法可以避免这种风险，使您的SQL语句更容易正确，并且运行更快。

//This could be marked const!
string query = "INSERT INTO student1(name,id,gender) values (@name, @id, @gender);";

using (var conn2 = new MySqlConnection(strconn))
using (var cmd = new MySqlCommand(query, conn2))
{ 
    //I have to guess, but you can find exact column types/lengths from your db
    //Do not use AddWithValue()!
    // MySql is less at risk for the AddWithValue() performance issues
    // than Sql Server but the risk isn't completely eliminated.
    cmd.Parameters.Add("@name", MySqlDbType.VarChar, 30).Value = name3.Text;
    cmd.Parameters.Add("@id", MySqlDbType.VarChar, 50).Value = id3.Text; 
    cmd.Parameters.Add("@gender", MySqlDbType.VarChar, 5).Value = gender3.SelectedValue;

    conn2.Open();
    cmd.ExecuteNonQuery();
}

Answer 2

 using (MySqlConnection conn2 = new MySqlConnection(strconn))
            {
                String query = "INSERT INTO student1(name,id,gender) values (@name,@id,@gender)";
                MySqlCommand = new MySqlCommand(query, conn2);
                command.Parameters.AddWithValue("@name", name3.Text);
                command.Parameters.AddWithValue("@id", id3.Text);
                command.Parameters.AddWithValue("@gender", gender3.SelectedValue.ToString());
                command.ExecuteNonQuery();
            }

使用需要使用的参数