Question

Asp中将TextBox控件的内容插入到sql2005的数据库中

string str = "Server=.;DataBase=Student;user id=sa;password=123";
SqlConnection myConnection = new SqlConnection(str);
myConnection.Open();
string str1 = TextBox1.Text;
string str2 = TextBox2.Text;
string str3 = "Insert into User_Info(Name,Password) values(str1,str2)";
SqlCommand myCommand = new SqlCommand(str3,myConnection);
myCommand.ExecuteNonQuery();
myConnection.Close();
错误提示：在此上下文中不允许使用名称 "str1"。有效表达式包括常量、常量表达式和变量(在某些上下文中)。不允许使用列名

Answer 1

string str1 = TextBox1.Text;
string str2 = TextBox2.Text;
SqlParameter[] sp = new SqlParameter[]{
new SqlParameter("@name",str1 ),
new SqlParameter("@password",str2 )
};
string sql = "insert bg_class(name,password) values(@name,@password)";

Answer 2

sql语句应为：insert into user_info(name,password) values('"+str1+"','"+str2+"')
str1、str2 是变量