C# MySqlCommand Command.Parameters.Add 已过时
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/13580993/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
MySqlCommand Command.Parameters.Add is obsolete
提问by Mathlight
I'm making an C# windows Form Application in visual studio 2010.
我正在 Visual Studio 2010 中制作 C# windows 窗体应用程序。
That application is connecting to an mysql database, and I want to insert data in it.
该应用程序正在连接到 mysql 数据库，我想在其中插入数据。
Now do I have this part of code:
现在我有这部分代码：
MySqlConnection connection;
string cs = @"server=server ip;userid=username;password=userpass;database=databse";
connection = new MySqlConnection(cs);
connection.Open();
MySqlCommand command = new MySqlCommand();
string SQL = "INSERT INTO `twMCUserDB` (`mc_userName`, `mc_userPass`, `tw_userName`, `tw_userPass`) VALUES ('@mcUserName', '@mcUserPass', '@twUserName', '@twUserPass')";
command.CommandText = SQL;
command.Parameters.Add("@mcUserName", mcUserNameNew);
command.Parameters.Add("@mcUserPass", mcUserPassNew);
command.Parameters.Add("@twUserName", twUserNameNew);
command.Parameters.Add("@twUserPass", twUserPassNew);
command.Connection = connection;
command.ExecuteNonQuery();
connection.Close();
The connection is fine. That works.
连接很好。那个有效。
I readed herethat the way that I have now, is an save way to do query's. Is that still right?
我在这里读到，我现在拥有的方式是一种进行查询的保存方式。还是这样吗？
And now to the real question. With that code above, I get the following warning in visual studio:
现在是真正的问题。使用上面的代码，我在 Visual Studio 中收到以下警告：
'MySql.Data.MySqlClient.MySqlParameterCollection.Add(string, object)' is obsolete: '"Add(String parameterName, Object value) has been deprecated. Use AddWithValue(String parameterName, Object value)"'
That warning is for every parameters.add
该警告适用于每个 parameters.add
And it isn't even working, because the values that are inserted are @mcUserName, @mcUserPass and so on, instead of the values that the variables mcUserNameNew and so on are holding...
它甚至不起作用，因为插入的值是@mcUserName、@mcUserPass 等，而不是变量 mcUserNameNew 等保存的值......
So my question is, am I doing something wrong, and what is the new way to sql injection save do an query?
所以我的问题是，我做错了什么，sql注入保存的新方法是什么？
采纳答案by John Woo
try AddWithValue
尝试 AddWithValue
command.Parameters.AddWithValue("@mcUserName", mcUserNameNew);
command.Parameters.AddWithValue("@mcUserPass", mcUserPassNew);
command.Parameters.AddWithValue("@twUserName", twUserNameNew);
command.Parameters.AddWithValue("@twUserPass", twUserPassNew);
and don't wrap the placeholders with single quotes.
并且不要用单引号包裹占位符。
string SQL = "INSERT INTO `twMCUserDB` (`mc_userName`, `mc_userPass`, `tw_userName`, `tw_userPass`) VALUES (@mcUserName, @mcUserPass, @twUserName, @twUserPass)";
回答by Chris
@mcUserName has to match the mc_userName in the query ..
@mcUserName 必须匹配查询中的 mc_userName ..
so your parm should be @mc_userName
所以你的参数应该是@mc_userName
回答by David
This is VB code...
这是VB代码...
cmd.Parameters.AddWithValue("@number", 1) 'set @number as numeric
cmd.Parameters.AddWithValue("@text", "this will be a text variable")
cmd.Parameters("@number").Value = 321 'now @number has a value
cmd.Parameters("@text").Value = "A string value" 'now @text has a value
cmd.ExecuteNonQuery()
回答by Ramgy Borja
Just edit/remove some code in this part
只需编辑/删除这部分中的一些代码
('@mcUserName', '@mcUserPass', '@twUserName', '@twUserPass')
to
到
(@mcUserName, @mcUserPass, @twUserName, @twUserPass)
and Add( to AddWithValue(
和 Add( 到 AddWithValue(
回答by Adam Calvet Bohl
Edit:As Bradley Grainger pointed out, in MySQL is safe to use AddWithValue.
I'm keeping my answer if you get here by chance and use Microsoft SQL.
编辑：正如 Bradley Grainger 指出的那样，在 MySQL 中使用AddWithValue. 如果您偶然来到这里并使用 Microsoft SQL，我会保留我的答案。
Please read this article, advising you against using AddWithValue:
请阅读这篇文章，建议您不要使用AddWithValue：
https://blogs.msmvps.com/jcoehoorn/blog/2014/05/12/can-we-stop-using-addwithvalue-already/
https://blogs.msmvps.com/jcoehoorn/blog/2014/05/12/can-we-stop-using-addwithvalue-already/
It says basically that AddWithValuecould sometimes incorrectly infer the correct type. Use Addinstead.
它基本上说AddWithValue有时可能会错误地推断出正确的类型。使用Add来代替。
