使用VBA插入SQL表

我有在SQL端创build的表和字段。 debugging器指向cnn.Execute uSQL是问题。 我正在尝试将正在访问表单的用户和计算机名称写入SQL。

Sub UpdateTable() Dim cnn As ADODB.Connection Dim uSQL As String Dim strText As String Dim strDate As Date Dim strUsername As String Dim strComputerName As String strUsername = Environ("username") strComputerName = Environ("Computername") Set cnn = New Connection cnnstr = "Provider=SQLOLEDB; " & _ "Data Source=icl-analive; " & _ "Initial Catalog=DW_ALL;" & _ "User ID=dw_all_readonlyuser;" & _ "Trusted_Connection=Yes;" cnn.Open cnnstr uSQL = "INSERT INTO Audit (UN,CN) VALUES StrUsername , strComputer" Debug.Print uSQL cnn.Execute uSQL cnn.Close Set cnn = Nothing Exit Sub End Sub 

Answer 1

你的uSQL应该是这样的：

 uSQL = "INSERT INTO Audit (UN,CN) VALUES " & StrUsername & "," & strComputer 

编辑：其实像这样：

 INSERT INTO Audit (UN,CN) VALUES '" & StrUsername & "','" & strComputer & "'" 

不同之处在于，我们应该在SQL的引号中设置string。 感谢@Tony Dong的评论。

编辑2：这个答案是一个SQL注入漏洞的代码的典型例子。为了防止它看到评论。