如何将记录添加到访问数据库-visual basic

Question

我做了一个测试，应该将用户的高分存储在数据库中，但我一直收到一个错误："不允许更改"ConnectionString">

这是我的代码：

Imports System.Data.OleDb
Public Class Pure
Dim pro As String
Dim connstring As String
Dim command As String
Dim myconnection As OleDbConnection = New OleDbConnection

这是代码的其余部分，它应该将高核心添加到访问数据库中

Private Sub btnSummary_Click(sender As Object, e As EventArgs) Handles btnSummary.Click
pro = "provider=microsoft.ACE.OLEDB.12.0;Data Source=flashcard login.accdb" 'Establish connection with database
connstring = pro
myconnection.ConnectionString = connstring
myconnection.Open() 'Open connection
If lblScore11.Text > lblHighScore.Text Then 'If current socre is greater than high score
lblScore11.Text = lblHighScore.Text
command = " insert into results ([score]) values ('" & lblHighScore.Text & "')"
Dim cmd As OleDbCommand = New OleDbCommand(command, myconnection) 'Establish connection
cmd.Parameters.Add(New OleDbParameter("score", CType(lblHighScore.Text, String)))
End If
End Sub    

我在末尾添加了这个try-catch语句(在if语句内部(

Try
cmd.ExecuteNonQuery()
cmd.Dispose()
myconnection.Close()
Catch ex As Exception
MsgBox(ex.Message)
End Try

Answer 1

还有其他问题，但最大的问题是您实际上需要运行查询：

cmd.ExecuteNonQuery()

此外，此查询仍然非常容易受到注入问题的攻击。这种字符串替换对于SQL字符串来说是不合适的：

values ('" & lblHighScore.Text & "')"

这里有一个完整的重写，有更好的模式：

Dim connString As String = "provider=microsoft.ACE.OLEDB.12.0;Data Source=flashcard login.accdb" 
Private Sub btnSummary_Click(sender As Object, e As EventArgs) Handles btnSummary.Click
If lblScore11.Text <= lblHighScore.Text Then Return
lblHighScore.Text = lblScore11.Text
Using conn As New OleDbConnection(connSstring), _
cmd As New OleDbCommand("INSERT INTO results ([score]) VALUES (?)", conn)
'Use the actual OleDbType that maps to the database column and length here
cmd.Parameters.Add("score", OleDbType.LongVarWChar).Value = lblScore11.Text
conn.Open()
cmd.ExecuteNonQuery()
End Using
End Sub