Click here to Skip to main content
15,889,849 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
the code works fine.. but when i look inside my tblstudent in my db, the text "System.Windows.Forms.TextBox, Text:" is automatically inserting to some of my fields..

for ex: mobile: 09xxxxxxx

"System.Windows.Forms.TextBox, Text: 09xxxxxxx" in my dbtable..

What I have tried:

SqlConnection cnn = new SqlConnection(cs.constring());
SqlDataAdapter adapter = new SqlDataAdapter();

string sql = "insert into tblstudent (sno,s_name,gender,age,birthday,civil_status,place_of_birth,address,citizenship,religion,blood_type,mobile,telephone,email,father,f_occupation,mother,m_occupation,guardian,g_relationship,g_address,g_mobile,admission_date) values('" + txtsno.Text + "','" +
   txtname.Text + "','" + cbogender.Text + "','" + txtage.Text + "','" + dtpbirthday.Text + "','" + cbostatus.Text + "','" + txtplaceofbirth.Text + "','" + txtaddress.Text + "','" + txtcitizenship.Text + "','" + txtreligion.Text + "','" + txtbloodtype.Text + "','" + txtmobile + "','" +
   txttel.Text + "','" + txtemail.Text + "','" + txtfather.Text + "','" + txtfoccupation.Text + "','" + txtmother.Text + "','" + txtmoccupation + "','" + txtguardian.Text + "','" + txtrelationship.Text + "','" + txtgaddress + "','" + txtgmobile.Text + "','" + dtpadmission.Text + "')";

if (MessageBox.Show("do you want to save?", "choose an option", MessageBoxButtons.YesNo) == DialogResult.Yes)
{
    try
    {
        cnn.Open();
        adapter.InsertCommand = new SqlCommand(sql, cnn);
        adapter.InsertCommand.ExecuteNonQuery();
        MessageBox.Show("record saved !! ");
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.ToString());
    }
}
else
{

}
Posted
Updated 21-Apr-17 1:03am

Its should be txtmobile.Text , txtmoccupation.Text, txtgaddress.Text

Note:
Formatting the sql Query string is vulnerable to SQL Injection[^] attacks
always use Parameterized queries to prevent SQL Injection Attacks in SQL Server[^]
 
Share this answer
 
v3
Comments
akosisugar 21-Apr-17 5:08am    
thank u!
Never build an SQL query by concatenating with user inputs, it is named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability.
SQL injection - Wikipedia[^]
SQL Injection[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900