SQL语句参数化(1)插入数据

    技术2022-05-11  47

    WebForm1.aspx

    Imports System.Text

    Public Class WebForm1    Inherits System.Web.UI.Page

    #Region " Web 窗体设计器生成的代码 "

        '该调用是 Web 窗体设计器所必需的。    <System.Diagnostics.DebuggerStepThrough()> Private Sub InitializeComponent()

        End Sub    Protected WithEvents TextBox1 As System.Web.UI.WebControls.TextBox    Protected WithEvents TextBox2 As System.Web.UI.WebControls.TextBox    Protected WithEvents TextBox3 As System.Web.UI.WebControls.TextBox    Protected WithEvents TextBox4 As System.Web.UI.WebControls.TextBox    Protected WithEvents TextBox5 As System.Web.UI.WebControls.TextBox    Protected WithEvents TextBox6 As System.Web.UI.WebControls.TextBox    Protected WithEvents Button1 As System.Web.UI.WebControls.Button

        '注意: 以下占位符声明是 Web 窗体设计器所必需的。    '不要删除或移动它。    Private designerPlaceholderDeclaration As System.Object

        Private Sub Page_Init(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Init        'CODEGEN: 此方法调用是 Web 窗体设计器所必需的        '不要使用代码编辑器修改它。        InitializeComponent()    End Sub

    #End Region    Dim myconn As New Conn    Dim mydata As New Getdata    Dim sql As StringBuilder = New StringBuilder

        Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load        mydata.myconn = New SqlClient.SqlConnection        mydata.myconn.ConnectionString = myconn.stringconnection        If Not Page.IsPostBack Then        End If    End Sub

        Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click

            sql.Append("insert into chanpin(")        sql.Append("chanpin_name,chanpin_bianhao,chanpin_xiaotu,chanpin_putongjia,chanpin_kucun,chanpin_xiangxi")        sql.Append(")")        sql.Append(" values(")        sql.Append("@chanpin_name,@chanpin_bianhao,@chanpin_xiaotu,@chanpin_putongjia,@chanpin_kucun,@chanpin_xiangxi")        sql.Append(")")

            Dim mypt As SqlClient.SqlParameter() = New SqlClient.SqlParameter() { _        New SqlClient.SqlParameter("@chanpin_name", SqlDbType.VarChar, 50), _        New SqlClient.SqlParameter("@chanpin_bianhao", SqlDbType.VarChar, 50), _        New SqlClient.SqlParameter("@chanpin_xiaotu", SqlDbType.VarChar, 1000), _        New SqlClient.SqlParameter("@chanpin_putongjia", SqlDbType.Decimal, 9), _        New SqlClient.SqlParameter("@chanpin_kucun", SqlDbType.Int, 4), _        New SqlClient.SqlParameter("@chanpin_xiangxi", SqlDbType.Text)}

            mypt(0).Value = TextBox1.Text        mypt(1).Value = TextBox2.Text        mypt(2).Value = TextBox3.Text        mypt(3).Value = TextBox4.Text        mypt(4).Value = TextBox5.Text        mypt(5).Value = TextBox6.Text

            mydata.myconn.Open()        mydata.executesql(sql.ToString, mypt)        ' mydata.executesql(sql.ToString, Nothing) '不需要用到参数时,传nothing

            mydata.myconn.Close()

        End SubEnd Class

     

    Getdata.vb

    Public Class Getdata

        Public myconn As SqlClient.SqlConnection

        Public Function executesql(ByVal sql As String, ByVal myPt As SqlClient.SqlParameter())        Dim myCmd As SqlClient.SqlCommand        myCmd = New SqlClient.SqlCommand(sql, myconn)               ' 存储过程时sql应改为存储过程名        ' myCmd.CommandType = CommandType.StoredProcedure ' 存储过程时需要添加该语句              If IsNothing(myPt) Then            myCmd.ExecuteNonQuery()        Else            Dim mypt1 As SqlClient.SqlParameter            For Each mypt1 In myPt                myCmd.Parameters.Add(mypt1)            Next            myCmd.ExecuteNonQuery()            myCmd.Parameters.Clear()        End If End Function   End Class 


    最新回复(0)