Mysql 无法在数据库中插入带有（'；）的数据，例如：Loop'；D未插入

当我用文本中的单个冒号

“

在文本框中写入数据时，查询显示以下错误：

“d”附近的语法不正确。字符串“，”，“，”，“，”）后的未闭合引号

---

不要使用字符串连接使sql。。。Google sqlcommand参数参数参数化查询将解决您的问题并增强您的代码对sql注入的抵抗力，all in one step.OP标记为MySQL，代码显示MS sql。

    protected void btnAdd_Click(object sender, EventArgs e)
    {
        string pic = "";
        if (fuPic1.HasFile)
        {
            string fPath1 = Server.MapPath("~/BlogPics/");
            fuPic1.SaveAs(fPath1 + fuPic1.FileName);
            pic = "~/BlogPics/" + fuPic1.FileName;

        }
        else
        {
            pic = "";
        }

        string pic1 = "";
        if (fuPic2.HasFile)
        {
            string fPath2 = Server.MapPath("~/BlogPics/");
            fuPic2.SaveAs(fPath2 + fuPic2.FileName);
            pic1 = "~/BlogPics/" + fuPic2.FileName;

        }
        else
        {
            pic1 = "";
        }
        SqlConnection con = new SqlConnection("Data Source=Saad_Zahid ;  Database=DJ ; Integrated Security=True; ");
        string query = "insert into Blog(Blog_Banner,Blog_Title,Blog_Para1,Blog_SubTitle,Blog_Para2,Blog_Img) values('" + pic + "','" + txtTitle.Text + "', '" + txtA1.InnerText + "','" + txtSTitle.Text + "','" + txtA2.InnerText + "','" + pic1 + "')";
        SqlCommand cmd = new SqlCommand(query, con);
        con.Open();
        cmd.ExecuteNonQuery();
        con.Close();
        img1.ImageUrl = pic;
        img2.ImageUrl = pic1;
        ScriptManager.RegisterStartupScript(this, this.GetType(), "alert", "alert('Blog Added');window.location ='AIndex.aspx';", true);

    }
  }
}