OK...
程序代码:
Protected Sub btnQuery_Click(sender As Object, e As System.EventArgs) Handles btnQuery.Click
Dim FileNo1 As String = "", FileNo2 As Integer = 0, FileNo3 As Integer = 0
Dim mySQL As String = "SELECT SubjectNo, SubFolderNo, FileNo FROM tblFileList Where FileName = '" & ClassNo.Text & "'"
Dim UserN As String = Mid(Mid(UserNo.Text, InStr(UserNo.Text, "(") + 1), 1, Len(Mid(UserNo.Text, InStr(UserNo.Text, "(") + 1)) - 1)
Try
Using mySqlDS = New SqlConnection(ConfigurationManager.ConnectionStrings(strCnnType & "DbBTA").ToString)
Dim myCmd As SqlCommand
myCmd = New SqlCommand(mySQL, mySqlDS)
mySqlDS.Open()
Using dbDRSQL = myCmd.ExecuteReader
While dbDRSQL.Read
FileNo1 = dbDRSQL("SubjectNo").ToString
FileNo2 = dbDRSQL("SubFolderNo").ToString
FileNo3 = dbDRSQL("FileNo").ToString
End While
End Using
End Using
Using myCnn As New SqlConnection(ConfigurationManager.ConnectionStrings(strCnnType & "DbBTA").ToString)
myCnn.Open()
Dim myCmd As SqlCommand
mySQL = "INSERT INTO tblSelectClass(UserID, ClassID, SubClassID, FileNo, StartDate, EndDate, StudyTime, StudyCount, StudyDate, Results, CreatorNo, CreateDate, ReviserNo, ReviseDate) VALUES ("
mySQL += "'" & UserN & "', '" & FileNo1 & "', " & FileNo2 & ", " & FileNo3 & ", '" & starttime.Text & "', '" & endtime.Text & "', "
mySQL += "0, 0,'','N','" & Session("LoginNo") & "', GetDate() ,'" & Session("LoginNo") & "', GetDate())"
myCmd = New SqlCommand(mySQL, myCnn)
myCmd.ExecuteNonQuery()
End Using
Catch ex As Exception
Dim strErr As String = "●●● 程式错误讯息如下 ●●●" & "\n\n" & Replace(Replace(Replace(Replace(Trim(ex.ToString()), Chr(10), ""), Chr(13), ""), "\", "\\"), "'", "\'")
ScriptManager.RegisterStartupScript(Me, Me.GetType(), "alert", "alert('" & strErr & "');", True)
End Try
End Sub
因为我这是公司内网网站所以不连外~就不做sql injection的防范了~
[此贴子已经被作者于2017-5-31 17:59编辑过]