C# 我从未见过的MySQL连接错误

新mysql错误：

ERROR [42000] [MySQL][ODBC 3.51 Driver][mysqld-5.5.9]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'System.Data.Odbc.OdbcCommand' at line 1 

我以前从未见过这个错误，也不知道它与什么有关

    using (OdbcConnection connection = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=root; Password=fakepass;"))
    {
        // ODBC command and transaction objects
        OdbcCommand command = new OdbcCommand();
        OdbcTransaction transaction = null;

        // tell the command to use our connection
        command.Connection = connection;

        try
        {
            // open the connection
            connection.Open();

            // start the transaction
            transaction = connection.BeginTransaction();

            // Assign transaction object for a pending local transaction.
            command.Connection = connection;
            command.Transaction = transaction;

            // TODO: Build a SQL INSERT statement
            OdbcCommand cmd = new OdbcCommand("INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES ('" + TextBox1.Text + "', '" + TextBox2.Text + "', '" + TextBox3.Text + "', '" + TextBox4.Text + "', '" + TextBox5.Text + "', '" + TextBox6.Text + "', '" + TextBox7.Text + "', '" + TextBox8.Text + "')", connection);

            // run the insert using a non query call
            command.CommandText = cmd.ToString();
            command.ExecuteNonQuery();

            /* now we want to make a second call to MYSQL to get the new index 
               value it created for the primary key.  This is called using scalar so it will
                return the value of the SQL  statement.  We convert that to an int for later use.*/
            command.CommandText = "select last_insert_id();";
            int id = Convert.ToInt32(command.ExecuteScalar());
            Label10.Text = Convert.ToString(id);
            // the name id doesnt not exist in the current context

            // Commit the transaction.
            transaction.Commit();
        }
        catch (Exception ex)
        {
            Label10.Text = ": " + ex.Message;

            try
            {
                // Attempt to roll back the transaction.
                transaction.Rollback();
            }
            catch
            {
                // Do nothing here; transaction is not active.
            }
        }
    }

编辑：

    using (var conn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=root; Password=fakepass;"))
    {
        conn.Open();
        using (var tx = conn.BeginTransaction())
        {
            using (var cmd = conn.CreateCommand())
            {
                cmd.CommandText = "INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES (@Email, @FirstName, @SecondName, @DOB, @Location, @Aboutme, @username, @password)";
                cmd.Parameters.AddWithValue("@Email", TextBox1.Text);
                cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
                cmd.Parameters.AddWithValue("@SecondName", TextBox3.Text);

                // TODO: might require a parsing if the column is of type date in SQL
                cmd.Parameters.AddWithValue("@DOB", TextBox4.Text);

                cmd.Parameters.AddWithValue("@Location", TextBox5.Text);
                cmd.Parameters.AddWithValue("@Aboutme", TextBox6.Text);
                cmd.Parameters.AddWithValue("@username", TextBox7.Text);
                cmd.Parameters.AddWithValue("@password", TextBox8.Text);
                cmd.ExecuteNonQuery();
//error on this line
            }

            using (var cmd = conn.CreateCommand())
            {
                cmd.CommandText = "select last_insert_id();";
                int id = Convert.ToInt32(cmd.ExecuteScalar());
                Label10.Text = Convert.ToString(id);
            }

            tx.Commit();
        }
    }

---

{“当分配给命令的连接处于挂起的本地事务中时，ExecuteOnQuery要求该命令具有事务。该命令的事务属性尚未初始化。”}

当存在错误时，为什么仍使用有缺陷的ODBC连接到MySql？形成查询时，这种可怕的字符串连接是什么

OdbcCommand cmd = new OdbcCommand("INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES ('" + TextBox1.Text + "', '" + TextBox2.Text + "', '" + TextBox3.Text + "', '" + TextBox4.Text + "', '" + TextBox5.Text + "', '" + TextBox6.Text + "', '" + TextBox7.Text + "', '" + TextBox8.Text + "')", connection);

你没听说过什么吗？哪种方法可以避免

我所能说的是，如果在编写SQL查询时使用

+

符号，就像拿着枪朝你的脚（或头部）开枪一样（取决于场景，但在所有情况下，你都是朝自己开枪，基本上是自杀行为）

因此，以下是正确的做法：

using (var conn = new MySqlConnection("Server=localhost; Database=gymwebsite2; User=root; Password=commando;"))
{
    conn.Open();
    using (var tx = conn.BeginTransaction())
    {
        using (var cmd = conn.CreateCommand())
        {
            cmd.CommandText = "INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES (@Email, @FirstName, @SecondName, @DOB, @Location, @Aboutme, @username, @password)";
            cmd.Parameters.AddWithValue("@Email", TextBox1.Text);
            cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
            cmd.Parameters.AddWithValue("@SecondName", TextBox3.Text);

            // TODO: might require a parsing if the column is of type date in SQL
            cmd.Parameters.AddWithValue("@DOB", TextBox4.Text);

            cmd.Parameters.AddWithValue("@Location", TextBox5.Text);
            cmd.Parameters.AddWithValue("@Aboutme", TextBox6.Text);
            cmd.Parameters.AddWithValue("@username", TextBox7.Text);
            cmd.Parameters.AddWithValue("@password", TextBox8.Text);
            cmd.ExecuteNonQuery();
        }

        using (var cmd = conn.CreateCommand())
        {
            cmd.CommandText = "select last_insert_id();";
            int id = Convert.ToInt32(cmd.ExecuteScalar());
            Label10.Text = Convert.ToString(id);
        }

        tx.Commit();
    }
}

---

另外，请适当地命名这些文本框。要维护这段代码的可怜家伙可能会发出绝望的尖叫。

当出现问题时，为什么你仍然使用有缺陷的ODBC连接MySql？形成查询时，这种可怕的字符串连接是什么

OdbcCommand cmd = new OdbcCommand("INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES ('" + TextBox1.Text + "', '" + TextBox2.Text + "', '" + TextBox3.Text + "', '" + TextBox4.Text + "', '" + TextBox5.Text + "', '" + TextBox6.Text + "', '" + TextBox7.Text + "', '" + TextBox8.Text + "')", connection);

你没听说过什么吗？哪种方法可以避免

我所能说的是，如果在编写SQL查询时使用

+

符号，就像拿着枪朝你的脚（或头部）开枪一样（取决于场景，但在所有情况下，你都是朝自己开枪，基本上是自杀行为）

因此，以下是正确的做法：

using (var conn = new MySqlConnection("Server=localhost; Database=gymwebsite2; User=root; Password=commando;"))
{
    conn.Open();
    using (var tx = conn.BeginTransaction())
    {
        using (var cmd = conn.CreateCommand())
        {
            cmd.CommandText = "INSERT INTO User (Email, FirstName, SecondName, DOB, Location, Aboutme, username, password) VALUES (@Email, @FirstName, @SecondName, @DOB, @Location, @Aboutme, @username, @password)";
            cmd.Parameters.AddWithValue("@Email", TextBox1.Text);
            cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
            cmd.Parameters.AddWithValue("@SecondName", TextBox3.Text);

            // TODO: might require a parsing if the column is of type date in SQL
            cmd.Parameters.AddWithValue("@DOB", TextBox4.Text);

            cmd.Parameters.AddWithValue("@Location", TextBox5.Text);
            cmd.Parameters.AddWithValue("@Aboutme", TextBox6.Text);
            cmd.Parameters.AddWithValue("@username", TextBox7.Text);
            cmd.Parameters.AddWithValue("@password", TextBox8.Text);
            cmd.ExecuteNonQuery();
        }

        using (var cmd = conn.CreateCommand())
        {
            cmd.CommandText = "select last_insert_id();";
            int id = Convert.ToInt32(cmd.ExecuteScalar());
            Label10.Text = Convert.ToString(id);
        }

        tx.Commit();
    }
}

---

另外，请适当地命名这些文本框。维护这段代码的可怜人可能会发出绝望的尖叫。

我注意到保存SQL语法的代码行相当长。您可以在引号前放置一个

@

符号，使字符串能够跨越多行。此外，它看起来像你打开了自己的SQL注入构建你的查询这样。如果这是一个外部可访问的服务器，你也打开了自己的攻击，张贴你的SQL用户名和密码这样。我注意到代码行保存你的SQL语法是相当长的。您可以在引号前放置一个

@

符号，使字符串能够跨越多行。另外，看起来您正在向SQL注入敞开大门构建这样的查询。如果这是一个外部可访问的服务器，那么您也会通过发布这样的SQL用户名和密码来向攻击敞开大门。此外，我发现重复使用该命令非常危险，我建议为一个全新的应用程序实例化一个新命令task@Garrith格雷厄姆，从我在代码中看到的情况来看，您使用的是

OdbcConnection

，它与

MySqlConnection

完全不同。当分配给该命令的连接处于挂起的本地事务中时，ExecuteNonQuery要求该命令具有事务。该命令的事务属性尚未初始化。在调试时，请在paramartersLOL@后面的cmd.executenonquery行上正确命名这些文本框。维护这段代码的可怜的家伙可能会发出绝望的尖叫。另外，我发现命令的重用非常危险，我建议为一个全新的命令实例化一个新命令task@Garrith格雷厄姆，从我在代码中看到的情况来看，您使用的是

OdbcConnection

，它与

MySqlConnection

完全不同。当分配给该命令的连接处于挂起的本地事务中时，ExecuteNonQuery要求该命令具有事务。该命令的事务属性尚未初始化。在调试时，请在paramartersLOL@后面的cmd.executenonquery行上正确命名这些文本框。这个可怜的家伙可能会发出绝望的尖叫