SQL INSERT-无效的列名

列名后缺少括号，该值表示字符串，因此必须用引号引起来：

string sqlpre = "INSERT INTO file_uploads (upload_filename) " +       "VALUES ('"+filename+"')";

但是，正确的方法是使用参数化查询：

string filename = "abc123.jpg";SqlConnection link = new SqlConnection();string sqlpre = "INSERT INTO file_uploads (upload_filename) VALUES (@filename)";SqlCommand sql = new SqlCommand(sqlpre,link);sql.Parameters.AddWithValue("@filename", filename);link.open();sql.ExecuteNonQuery();