C Failed to write database data, C Database write error

Try to capture the return value.

1. Confirm that the database connection is correct.

insert into zc_info(yhm,mm)");

values('" + "','" + "')");

SQL problematic values should be preceded by spaces.

To add a space, you need to put a space in front of the values.

insert into zc_info(yhm,mm) ");

values('" + "','" + "')");

The error is reported because the syntax of the SQL statement you spelled is incorrect, and the quotation marks do not appear in pairs.

1. Re-splice the SQL statement, string sql =" insert into ..values (

It must be when splicing" ' "+ Variables+" ' "This is how it appeared. Although the int type can be used without quotation marks in SQL statements, it is better to use single quotation marks for concatenation from C, and it will not cause errors.

2. Use parameter to pass parameters.

Splicing SQL can be problematic and unsightly.

The most common vulnerabilities are SQL injection, such as user input during queries"0 or 1=1", spell it into your SQL statement"select * from table where id = 0 or 1=1 ;This will find out all the information, which is very insecure.

This kind of problem can be avoided with sqlparameter:

string sql = "insert into table (name,age) values (@name,@age);

var paras = new sqlparameter

new sqlparameter("@name", ,new sqlparameter("@age", ,sql,paras);

This is an executed function, which can be wrapped by itself, and there are a lot of overloads in it. What is passed is the connection string, SQL type,

statements, variables, etc.

The program will automatically treat the @name @age in the statement as a variable, and pass in the value of the parameter group paras you wrote.

There is an error in SQL splicing,'1,'1, 1, one less'.

It should be'1','1'