ado.net mysql 转义_ADO.NET数据库查询

谁能给我解释一下下面三种向数据库中插入数据的不同：现谢谢了！！还有就是为什么第三种方法的cmd.Parameters.Add(newSqlParameter("@yu_tm",SqlDbType.DateTime));一定要把变量定义成...

谁能给我解释一下下面三种向数据库中插入数据的不同：

现谢谢了！！

还有就是为什么第三种方法的cmd.Parameters.Add(new SqlParameter("@yu_tm", SqlDbType.DateTime));一定要把变量定义成DateTime类型的；

而前两种就不用定义；(数据库中字段"yu_tm"的类型为DateTime型)

string a = TextBox1.Text.ToString();

string b = TextBox2.Text.ToString();

string c = TextBox3.Text.ToString();

string d = Label1.Text.ToString();

Response.Write(d);

string connectionstring = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;

SqlConnection cnn = new SqlConnection(connectionstring);

string sql = "insert into yu_pm(yu_name,yu_pm_sj,yu_pm_ch,yu_tm) values('" + a + "','" + b + "','" + c + "','" + d + "')";

SqlCommand cmd = new SqlCommand(sql, cnn);

cnn.Open();

SqlDataReader red = cmd.ExecuteReader();

red.Close();

cmd.ExecuteNonQuery();

cnn.Close();

GridView1.DataBind();

Response.Redirect("datareader_Test1.aspx");

这里的数据库连接跟上面的一样

string sql = "insert into yu_pm(yu_name,yu_pm_sj,yu_pm_ch,yu_tm) values('" + a + "','" + b + "','" + c + "','" + d + "')";

SqlCommand cmd = new SqlCommand(sql, cnn);

cnn.Open();

SqlDataAdapter da = new SqlDataAdapter(cmd);

DataSet ds = new DataSet();

da.Fill(ds);

cnn.Close();

GridView1.DataBind();

Response.Redirect("datareader_Test1.aspx");

这里的数据库连接跟上面的一样

string sql = "insert into yu_pm(yu_name,yu_pm_sj,yu_pm_ch,yu_tm) values(@yu_name,@yu_pm_sj,@yu_pm_ch,@yu_tm)";

SqlCommand cmd = new SqlCommand(sql, cnn);

cnn.Open();

cmd.Parameters.Add(new SqlParameter("@yu_name", SqlDbType.NVarChar, 50));

cmd.Parameters["@yu_name"].Value = a;

cmd.Parameters.Add(new SqlParameter("@yu_pm_sj", SqlDbType.NVarChar, 10));

cmd.Parameters["@yu_pm_sj"].Value = b;

cmd.Parameters.Add(new SqlParameter("@yu_pm_ch", SqlDbType.NVarChar, 10));

cmd.Parameters["@yu_pm_ch"].Value = c;

cmd.Parameters.Add(new SqlParameter("@yu_tm", SqlDbType.DateTime));

cmd.Parameters["@yu_tm"].Value = d;

cmd.ExecuteNonQuery();

cnn.Close();

GridView1.DataBind();

Response.Redirect("datareader_Test1.aspx");

展开