There are more columns in the insert statement values specified in the values clause

Question

1.00/5 (1 vote)

See more:

i have problem

i add btn

VB

cmd = New SqlCommand("insert into TBLSubScriptions ([Name],[PhoneNo],[Weight],[Length],[TimeClass],[subscriptionStart],[subscriptionEnd])
values ('" & txtName.Text & "','" & txtphone.Text & "','" & txtwigh.Text & "," & txtLength.Text & "','" & comoTimecl.Text & "','" & txtDatest.Value.Date & "','" & txtenddate.Value.Date & "')", con)

i have error
there are more columns in the insert statement values specified in the values Clause

What I have tried:

i will tried but no solve

i tried solve but noway

VB

cmd = New SqlCommand("insert into TBLSubScriptions ([Name],[PhoneNo],[Weight],[Length],[TimeClass],[subscriptionStart],[subscriptionEnd])
values ('" & txtName.Text & "','" & txtphone.Text & "','" & txtwigh.Text & "," & txtLength.Text & "','" & comoTimecl.Text & "','" & txtDatest.Value.Date & "','" & txtenddate.Value.Date & "')", con)

Posted 1-Apr-17 5:17am

Member 13099338

Updated 1-Apr-17 19:48pm

PIEBALDconsult

v2

Add a Solution

Comments

Graeme_Grant 1-Apr-17 11:20am

"there are more columns in the insert statement values specified in the values Clause"

It explains the issue very clearly. Count your fields and count you values in your SQL statement, they don't match!

Member 13099338 1-Apr-17 11:25am

The number of fields is equal with some

[no name] 1-Apr-17 11:30am

No it isn't. Use a proper parameterized query and you would not have the missing ' character problem that you have now. And you will save your database from an SQL injection attack at the same time.

PIEBALDconsult 1-Apr-17 11:53am

Always use parameterized statements.
And format your SQL so it's more readable.

3 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Karthik_Mahalingam · Answer 1 · 2017-04-01T19:47:00

Formatting the sql Query string is vulnerable to SQL Injection[^] attacks
always use Parameterized queries to prevent SQL Injection Attacks in SQL Server[^]

VB

cmd = New SqlClient.SqlCommand("insert into TBLSubScriptions (Name,PhoneNo,Weight,Length,TimeClass,subscriptionStart,subscriptionEnd)values (@Name,@PhoneNo,@Weight,@Length,@TimeClass,@subscriptionStart,@subscriptionEnd)")
cmd.Parameters.AddWithValue("@Name", txtName.Text)
cmd.Parameters.AddWithValue("@PhoneNo", txtphone.Text)
cmd.Parameters.AddWithValue("@Weight", txtwigh.Text)
cmd.Parameters.AddWithValue("@Length", txtLength.Text)
cmd.Parameters.AddWithValue("@TimeClass", comoTimecl.Text)
cmd.Parameters.AddWithValue("@subscriptionStart", txtDatest.Value.Date)
cmd.Parameters.AddWithValue("@subscriptionEnd", txtenddate.Value.Date)

Patrice T · Answer 2 · 2017-04-01T06:21:00

Never build an SQL query by concatenating with user inputs, it is named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability.
SQL injection - Wikipedia[^]
SQL Injection[^]

Your actual problem is about single quotes matching with your data

VB

' Error here         V                 and                       V
& txtphone.Text & "','" & txtwigh.Text & "," & txtLength.Text & "','" & comoTimecl.Text &

Michael_Davies · Answer 3 · 2017-04-01T05:34:00

Solution 1

If you used a parameterised query it would make it clearer.

However look at txtwigh.text, no single quote after, thus it merges with the next field.

Posted 1-Apr-17 5:34am

Michael_Davies

Updated 1-Apr-17 5:35am

v2

There are more columns in the insert statement values specified in the values clause

3 solutions

Solution 3

Solution 2

Solution 1

Add your solution here

Preview 0