2 SQLコマンド異なるテーブルへの挿入と更新

Question

には、2つのsqlコマンドと異なるテーブルのコマンドがあります。 ここに私のコードです。

private void button1_Click(object sender, EventArgs e) 
    { 
     string txtbx9 = textBox9.Text.ToString(); 
     string cmbbx2 = comboBox2.SelectedItem.ToString(); 
     string name = textBox1.Text.ToString(); 
     string surname = textBox2.Text.ToString(); 
     string company = textBox3.Text.ToString(); 
     string txtbx8 = textBox8.Text.ToString(); 
     string sts = "In House"; 

      try 
      { 
       connection.Open(); 


       MessageBox.Show("Payment approved."); 
       richTextBox1.Text = richTextBox1.Text + "The hotel received " + txtbx9 + " from this guest"; 
       string rtb = richTextBox1.Text.ToString(); 

      OleDbCommand command = new OleDbCommand(); 
       command.Connection = connection; 
       command.CommandText = "INSERT INTO billing(g_name,g_surname,g_company,g_totalrate, g_paid, g_typepaid, info, u_add, u_tadd, g_ad, g_dd, g_amountofdays) VALUES('" + name + "','" + surname + "','" + company + "','" + txtbx8 + "', '" + txtbx9 + "', '" + cmbbx2 + "', '" + rtb + "', '" + label12.Text.ToString() + "', '" + this.dateTimePicker1.Value +"','"+textBox4.Text.ToString()+"','"+textBox5.Text.ToString()+"','"+textBox6.Text.ToString()+"')"; ; 
       command.ExecuteNonQuery(); 
       command.CommandType = CommandType.Text; 
       command.CommandText = "UPDATE guestreg SET g_paidstatus='Paid '"+txtbx9+"'' where g_name ='"+name+"' and g_status = '"+sts"'"; 

       command.Connection = connection; 
       connection.Open(); 
       command.ExecuteNonQuery(); 

     } 

この2つのコマンドを一緒に実行するにはどうすればよいですか。 プログラムは、最初のSQLコマンドを実行しますが、ない二番目の

Answer 1

あなたは、両方のコマンドにで表彰を実行できます。

try 
{ 
     connection.Open(); 

     MessageBox.Show("Payment approved."); 
     richTextBox1.Text = richTextBox1.Text + "The hotel received " + txtbx9 + " from this guest"; 
     string rtb = richTextBox1.Text.ToString(); 
     command.Connection = connection; 
     command.CommandText = "INSERT INTO billing(g_name,g_surname,g_company,g_totalrate, g_paid, g_typepaid, info, u_add, u_tadd, g_ad, g_dd, g_amountofdays) VALUES('" + name + "','" + surname + "','" + company + "','" + txtbx8 + "', '" + txtbx9 + "', '" + cmbbx2 + "', '" + rtb + "', '" + label12.Text.ToString() + "', '" + this.dateTimePicker1.Value +"','"+textBox4.Text.ToString()+"','"+textBox5.Text.ToString()+"','"+textBox6.Text.ToString()+"')"; 
     command.CommandText += "\nUPDATE guestreg SET g_paidstatus='Paid '"+txtbx9+"'' where g_name ='"+name+"' and g_status = '"+sts"'"; 
     command.ExecuteNonQuery(); 
} 

それとも、他の後にそれらを1つずつ実行します。

try 
{ 
     connection.Open(); 

     MessageBox.Show("Payment approved."); 
     richTextBox1.Text = richTextBox1.Text + "The hotel received " + txtbx9 + " from this guest"; 
     string rtb = richTextBox1.Text.ToString(); 
     command.Connection = connection; 
     command.CommandText = "INSERT INTO billing(g_name,g_surname,g_company,g_totalrate, g_paid, g_typepaid, info, u_add, u_tadd, g_ad, g_dd, g_amountofdays) VALUES('" + name + "','" + surname + "','" + company + "','" + txtbx8 + "', '" + txtbx9 + "', '" + cmbbx2 + "', '" + rtb + "', '" + label12.Text.ToString() + "', '" + this.dateTimePicker1.Value +"','"+textBox4.Text.ToString()+"','"+textBox5.Text.ToString()+"','"+textBox6.Text.ToString()+"')"; 
     command.ExecuteNonQuery(); 
     command.CommandText = "UPDATE guestreg SET g_paidstatus='Paid '"+txtbx9+"'' where g_name ='"+name+"' and g_status = '"+sts"'"; 
     command.ExecuteNonQuery(); 
} 

編集：

スティーブが言及したように（そして彼は絶対に正しい）、パラメータを渡す必要がありますSqlParametersとなります。

try 
{ 
     connection.Open(); 

     MessageBox.Show("Payment approved."); 
     richTextBox1.Text = richTextBox1.Text + "The hotel received " + txtbx9 + " from this guest"; 
     string rtb = richTextBox1.Text.ToString(); 
     command.Connection = connection; 
     command.CommandText = "INSERT INTO billing(g_name,g_surname,g_company,g_totalrate, g_paid, g_typepaid, info, u_add, u_tadd, g_ad, g_dd, g_amountofdays) VALUES(@name,@surname,@company,@txtbx8,@txtbx9,@cmbbx2,@rtb,@label12Text,@dateTimePicker1Value,@textBox4Text,@textBox5Text,@textBox6Text')"; 
     command.Parameters.Add(new SqlParameter("@name",name)); 
     command.Parameters.Add(new SqlParameter("@surname",surname)); 
     command.Parameters.Add(new SqlParameter("@company",company)); 
     command.Parameters.Add(new SqlParameter("@txtbx8",txtbx8)); 
     command.Parameters.Add(new SqlParameter("@txtbx9",txtbx9)); 
     command.Parameters.Add(new SqlParameter("@cmbbx2",cmbbx2)); 
     command.Parameters.Add(new SqlParameter("@rtb",rtb)); 
     command.Parameters.Add(new SqlParameter("@label12Text",label12.Text.ToString())); 
     command.Parameters.Add(new SqlParameter("@dateTimePicker1Value",this.dateTimePicker1.Value.ToString())); 
     command.Parameters.Add(new SqlParameter("@textBox4Text",textBox4.Text.ToString())); 
     command.Parameters.Add(new SqlParameter("@textBox5Text",textBox5.Text.ToString())); 
     command.Parameters.Add(new SqlParameter("@textBox6Text",textBox6.Text.ToString())); 
     command.ExecuteNonQuery(); 
     command.CommandText = "UPDATE guestreg SET g_paidstatus=@paidStatus where g_name =@name and g_status = @status"; 
     command.Parameters.Add(new SqlParameter("@paidStatus","Paid " + txtbx9)); 
     command.Parameters.Add(new SqlParameter("@name",name)); 
     command.Parameters.Add(new SqlParameter("@status",sts)); 
     command.ExecuteNonQuery(); 
} 

Answer 2

あなたがこれを使用することができます：「オニール」あなたのコードを壊さない（パラメータ名は、より良いかもしれない）のような予想外の入力という、利点は、SQLインジェクションに対して優れた安全性であり、あなたは確認することができます。コマンドを2回作成する必要があります。

private void button1_Click(object sender, EventArgs e) 
{ 
string txtbx9 = textBox9.Text.ToString(); 
string cmbbx2 = comboBox2.SelectedItem.ToString(); 
string name = textBox1.Text.ToString(); 
string surname = textBox2.Text.ToString(); 
string company = textBox3.Text.ToString(); 
string txtbx8 = textBox8.Text.ToString(); 
string sts = "In House"; 

    try 
    { 
     connection.Open(); 


     MessageBox.Show("Payment approved."); 
     richTextBox1.Text = richTextBox1.Text + "The hotel received " + txtbx9 + " from this guest"; 
      string rtb = richTextBox1.Text.ToString(); 

     OleDbCommand command = new OleDbCommand(); 

     command.Connection = connection; 
     command.CommandText = "INSERT INTO billing(g_name,g_surname,g_company,g_totalrate, g_paid, g_typepaid, info, u_add, u_tadd, g_ad, g_dd, g_amountofdays) VALUES('" + name + "','" + surname + "','" + company + "','" + txtbx8 + "', '" + txtbx9 + "', '" + cmbbx2 + "', '" + rtb + "', '" + label12.Text.ToString() + "', '" + this.dateTimePicker1.Value +"','"+textBox4.Text.ToString()+"','"+textBox5.Text.ToString()+"','"+textBox6.Text.ToString()+"')"; ; 
     command.ExecuteNonQuery(); 

     command = new OleDbCommand(); 
     command.Connection = connection; 
     command.CommandText = "UPDATE guestreg SET g_paidstatus='Paid '"+txtbx9+"'' where g_name ='"+name+"' and g_status = '"+sts"'"; 

     command.ExecuteNonQuery(); 

} 
} 

Answer 3

はそれを行うには多くの方法がありますが、私のための最も簡単な方法は、閉じて、再はこのようにそれを行うことです：

は

SqlCommand importCommand = new SqlCommand("select * from * ", connection); 
     SqlDataReader sqlDR = importCommand.ExecuteReader(); 
     int index = 0; 
     while (sqlDR.Read()) { //something } 
     sqlDR.Close(); 

     index = 0; 
     importCommand = new SqlCommand("select * from * ", connection); 
     sqlDR = importCommand.ExecuteReader(); 
     sqlDR.Close();