C# 我不知道'；我不理解为什么此SQL语句不'；行不通

我正在asp.net中编写一个页面以获取日程安排。我使用模板字段来更新

GridView

，并将输入的信息保存到access数据库中。由于某些原因，当我运行update命令时，它无法正确地更新数据库。如果你看到什么，请告诉我

行更新事件的代码：

protected void table1_RowUpdating(object sender, GridViewUpdateEventArgs e)
{
    //get the value in the fullname textbox and assign it t a string varible
    TextBox txtFull = (TextBox)(table1.Rows[e.RowIndex].FindControl("txtfullname"));
    string FullName = txtFull.Text;
    //split the fullname string and assign the first and last name to new string variables
    //accordingly
    string[] splitstring = FullName.Split(' ');
    string firstName = splitstring[0];
    string lastName = splitstring[1];

    //assign the first and last name to the appropriate updateparameters
    SqlDataSource1.UpdateParameters["FirstName"].DefaultValue = firstName;
    SqlDataSource1.UpdateParameters["LastName"].DefaultValue = lastName;
    SqlDataSource1.UpdateParameters["FullName"].DefaultValue = FullName;

    //concantenate the username of the user's schedule you are editing.
    string username = firstName + "." + lastName;

    //instantiate an array with all the names of the updateparameters
    string[] dayArray = new string[] { "sun1","mon1","tues1","wed1","thurs1"
        ,"fri1","sat1","sun2","mon2","tues2","wed2","thurs2","fri2","sat2"};

    //loop through the controls and assign the text value of the textboxes to
    //the sqlUpdateParameters
    for (int i = 0; i < table1.Columns.Count - 4; i++)
    {
        TextBox day = (TextBox)(table1.Rows[e.RowIndex].FindControl("txt" + dayArray[i]));
        string strDay = day.Text;
        SqlDataSource1.UpdateParameters[i].DefaultValue = strDay;
    }

    string totHours = calcHours(sender, e).ToString();

    //assign the calculated total amount of hours to the totHours UpdateParameter
    SqlDataSource1.UpdateParameters["totHours"].DefaultValue = totHours;

    //set the update statement for the SqlDataSource to update the database with the 
    //information pulled from the form

    if (Convert.ToDouble(totHours) > 0)
    {
        SqlDataSource1.UpdateCommand = "UPDATE Employee SET FullName = @FullName," +
            "FirstName = @FirstName, LastName = @LastName, Sunday1 = @sun1, Monday1 = @mon1," +
            "Tuesday1 = @tues1, Wednesday1 = @wed1, Thursday1 = @thurs1, Friday1 = @fri1," +
            "Saturday1 = @sat1, Sunday2 = @sun2, Monday2 = @mon2, Tuesday2 = @tues2," +
            "Wednesday2 = @wed2, Thursday2 = @thurs2, Friday2 = @fri2, Saturday2 = @sat2," +
            "TotalHoursWorked = @totHours WHERE UserName = '" + username + "'";

        //run the update statement
        SqlDataSource1.Update();
    }
    //rebind the data in accordance with the admin

    BindData();
}

如果还需要什么，请告诉我，我会提供的

---

calc hours

如果该方法出错，则返回

-1000

。这就是为什么它会检查

totHours>0

注意，此代码容易受到SQL注入攻击。你应该使用参数化查询，而不是字符串连接。它甚至还没有接近完成，而且不管数据库中没有任何敏感数据。只保存名字和姓氏等。注入攻击不仅仅是窃取敏感信息。这更多的是关于键入姓氏“smith”；--删除用户”并破坏数据库。您正在按编号索引SQL参数和表列。你确定它们的顺序是一样的吗？可能不会，因为这是结果。最好按名称编制索引。是的，它们的顺序相同。从第一个星期天的位置0开始到第二个星期六。

protected void BindData()
{
    //get the username from the cookies collection and assign it to a string varialbe
    string username = Request.Cookies["username"].Value;
    string HouseID = Request.Cookies["houseID"].Value;
    //make the sql select parameter equal to the username of the user that is logged in
    SqlDataSource1.SelectParameters["username"].DefaultValue = username;
    //check to if the user logged in is a admin. if it is then display everthing associated
    //with the houssID depending on which button was pressed, otherwise 
    //display the schedule associated with the user that is logged in.
    if (username == "admin")
    {
        if (HouseID == "5")
        {
            SqlDataSource1.SelectCommand = "SELECT * FROM Employee";
        }
        else
        {
            SqlDataSource1.SelectCommand = "SELECT * FROM Employee WHERE houseID = '" + HouseID + "'";
        }
    }
    else
    {
        SqlDataSource1.SelectCommand = "SELECT * FROM Employee WHERE UserName = '" + username + "'";
        table1.Columns[0].Visible = false;
    }
    //rebind the sqldatasource to the gridview to display the schedule correctly
    table1.DataBind();
}