SQL Parameters Inside A Loop

问题

i have a list that i am pulling things out of to insert into a database. This is not going to be a web app so i have just been doing as follows:

string sqlStorage = (null,"asd"),

for (int i = 1; i < listsize; )
{

sqlStorage = sqlStorage + "(null,someVariableFromLoop)";

i++

}

string connString = "Server=localhost;...........";

MySqlConnection conn = new MySqlConnection(connString);
MySqlCommand command = conn.CreateCommand();
command.CommandText = @"INSERT INTO table1 VALUES " + tempSQLStorage;

etcetc...

However

"someVariableFromLoop"

is a large amount of text which includes all kinds of horrible code breaking characters. quotation marks etc etc.

So i looked into parameters (the way i should be doing SQL i know, i know), however i was unable to find a way to store these parameters inside the loop. i dont want to hit the DB every single iteration. I had a go at something along the lines of

"@variable"+i.toString();

but could not get it to work at all.

So does anyone have any idea how i would go about storing the parameters and the execute the query? Thanks in advance!

回答1:

Well, what was the error you received? Because that's the way you do it. Here's an example for MSSQL and I know the technique works, because I've done similar before:

int i = 0;
List<string> clauses = new List<string>() {"(@key0, @value0)"};
List<SqlParameter> paramList = new List<SqlParameter> {
    new SqlParameter("@key0", DBNull.Value), 
    new SqlParameter("@value0", "asd")
};
for (i = 1; i < listSize; i++) {
    clauses.Add("(@key" + i + ", @value" + i + ")");
    paramList.Add(new SqlParameter("@key" + i, someKey));
    paramList.Add(new SqlParameter("@value" + i, someValue);
}
SqlConnection conn = new SqlConnection(connString);
SqlCommand command = new SqlCommand(conn, @"INSERT INTO table1 VALUES " + String.Join(", ", clauses);
foreach(SqlParameter param in paramList) command.Parameters.Add(param);
command.ExecuteNonQuery();

Note, above code is quick and dirty. Obviously using statements and various other best practices should be incorporated as well for production code.

Also look at this: How do you use the MySql IN clause. It has an example of dynamically creating and passing parameters to the query, but for an SELECT...IN clause vs. INSERT...VALUES.

回答2:

To ensure secure code (and avoid malformed queries), use SQL Command objects with Parameters. There is nothing horribly wrong with executing the command once for every record - a little extra overhead for round-trips over the network, but if the text is long you might have to do this anyway since queries do have a character limit.

来源：https://stackoverflow.com/questions/24561055/sql-parameters-inside-a-loop

标签

sql

loops

sqlparameter