vb.net - 文字列から日時を変換する際に変換に失敗しました

Question

sql = "insert into tbl_nurse(nurseid,nursename,deptname,dob,doj,qualification,salary)"
            sql = sql & "values('" & txtNurseid.Text & "','" & TxtNursename.Text & "','" & Cmbdept.Text & "',convert(date,'" & DateTimePicker1.Value & "',103),convert(date,'" & DateTimePicker2.Value & "',103),'" & Txtqualification.Text & "','" & txtsalary.Text & "')"
            conn.Execute(sql)

Answer 1

sql-injectionを回避し、このような変換の問題を防ぐために、sql-parametersを使用する必要があります。

SQL-Server を想定した例:

Const sql = "INSERT INTO tbl_nurse(nurseid,nursename,deptname,dob,doj,qualification,salary)" & vbCrLf & _
            "VALUES(@nurseid, @nursename, @deptname, @dob, @doj, @qualification, @salary)"
Using con = New SqlConnection("Insert Your Connection String Here")
    Using cmd = New SqlCommand(sql, con)
        cmd.Parameters.AddWithValue("@nurseid", txtNurseid.Text)
        cmd.Parameters.AddWithValue("@nursename", TxtNursename.Text)
        cmd.Parameters.AddWithValue("@deptname", Cmbdept.Text)
        ' -- No conversion problems anymore because you pass a DateTime -- '
        cmd.Parameters.AddWithValue("@dob", DateTimePicker1.Value)
        ' ... other parameters ... '
        con.Open()
        Dim affectedRecords As Int32 = cmd.ExecuteNonQuery()
    End Using
End Using

Answer 2

このように変更してみてください..

sql = "insert into tbl_nurse(nurseid,nursename,deptname,dob,doj,qualification,salary)"

sql = sql & " values('" & txtNurseid.Text & "','" & TxtNursename.Text & "','" & Cmbdept.Text & "',#" & format(DateTimePicker1.Value.Date) & "#,#" & format(DateTimePicker2.Value.Date) & "#,'" & Txtqualification.Text & "','" & txtsalary.Text & "')"

conn.Execute(sql)

Tim Scmelter が言ったように.. パラメータ化された入力を使用する方が良い