Data conversion failed. Why?
Hello i recently got a problem in my Asp. Net C# 4 application. I am getting values from a开发者_如何学运维dress and then putting they into database. But framework give me "Data conversion failed. [ OLE DB status value (if known) = 2 ]" error. Here is my code:
var db = Database.Open("StarterSite");
var insert = db.Execute("INSERT INTO Downloads (ID, Name, Url, Size) VALUES ('@1', '@2', '@3', '@4')", Convert.ToInt32(Request.QueryString["fileid"]), Request.QueryString["name"], Request.QueryString["url"], Request.QueryString["size"]);
Where ID is int and Name, Url, Size is ntext. Please help me. Thanks!
The parameter markers that the Database helper accepts must start at 0
var db = Database.Open("StarterSite");
var insert = db.Execute("INSERT INTO Downloads (ID, Name, Url, Size) VALUES (@0, @1, @2, @3)", Request["fileid"], Request["name"], Request["url"], Request["size"]);
If the ID
column is an integer then don't wrap the value in quotes:
'@1'
should be @1
Note: What you have here is a SQL injection vulnerability. Never directly use query string input (or form input, or any user input) in a query like this. Look into parameterized queries, ORMs, etc. What you have here leaves your database wide open to attack.
精彩评论