.net core database insertion error

Question

0.00/5 (No votes)

See more:

While inserting data, I am encountring following error:
MySql.Data.MySqlClient.MySqlException: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1'\

ignore the SQL injection part for now.

Any help would be much appreciated!!!

C#

private void SaveData(string s)

        {


            var company = comboBox1.Text.ToString();
            int companyid = Convert.ToInt32(comboBox1.SelectedValue);
            var vendor = comboBox2.Text.ToString();
            int vendorid = Convert.ToInt32(comboBox2.SelectedValue);
            var POID = textBox3.Text.ToString();
            var expected_date = dateTimePicker2.Value.ToShortDateString();
            var todaydate = DateTime.Today;
            var itemPaymentNote = comboBox3.Text.ToString();

            try
            {
                MySqlConnection con = new MySqlConnection(ConfigurationManager.AppSettings["RL_InventoryConnection"]);
                if (con.State == ConnectionState.Closed)
                    con.Open();
                MySqlCommand cmd = new MySqlCommand("select * from vendormaster where vendor_id= +'" + vendorid + "' ;", con);
                MySqlDataReader dr1 = cmd.ExecuteReader();


                string VcontName1="", Vcontphone1 = "", Vcontemail1 = "", VcontName2 = "", Vcontphone2 = "" , Vcontemail2 = "";
                while (dr1.Read())
                {

                    VcontName1 = dr1["vendor_contact_Name1"].ToString();
                    Vcontphone1 = dr1["vendor_contact_phone1"].ToString();
                    Vcontemail1 = dr1["vendor_contact_email1"].ToString();

                    VcontName2 = dr1["vendor_contact_Name2"].ToString();
                    Vcontphone2 = dr1["vendor_contact_phone2"].ToString();
                    Vcontemail2 = dr1["vendor_contact_email2"].ToString();
                }

                dr1.Close();
                foreach (DataGridViewRow dr in dataGridView1.Rows)
                {
                    var ItemTypeCell = dr.Cells[0].Value;
                    var ItemNameCell = dr.Cells[1].Value;
                    var ItemModelCell = dr.Cells[2].Value;
                    var DescriptionCell = dr.Cells[3].Value;
                    var QuantityCell = dr.Cells[4].Value;
                    var UnitPriceCell = dr.Cells[5].Value;
                    var OtherNotesCell = dr.Cells[6].Value;
                    var GSTCell = dr.Cells[7].Value;
                    var CGSTCell = dr.Cells[8].Value;
                    var SGSTCell = dr.Cells[9].Value;
                    var ItemTotalCell = dr.Cells[10].Value;
                    Console.WriteLine(s);
                    var a = "N/A";

                    MySqlCommand cmd1 = new MySqlCommand("select * from categorymaster where category_name like '" + ItemTypeCell + "' ;", con);
                    MySqlDataReader dr2 = cmd1.ExecuteReader();
                    int ItemTypeCellValue=0;
                    while (dr2.Read())
                    {
                        ItemTypeCellValue = Convert.ToInt32(dr2["Cat_ID"]);
                    }
                    dr2.Close();


                    MySqlCommand cmd2 = new MySqlCommand("select bm.Brand_id, bm.Cat_id_fk, bm.Brand_name from brandmaster bm join categorymaster cm on cm.Cat_id =bm.Cat_id_fk where cm.Cat_id = " + ItemTypeCellValue + " and bm.Brand_name like '" + ItemNameCell + "' ;", con);
                    MySqlDataReader dr3= cmd2.ExecuteReader();
                    int ItemNameCellValue = 0;
                    while (dr3.Read())
                    {
                        ItemNameCellValue = Convert.ToInt32(dr3["Brand_id"]);
                    }
                    dr3.Close();

                    MySqlCommand cmd3 = new MySqlCommand("select mm.Model_name, mm.Model_id, mm.Brand_id_fk from modelmaster mm join brandmaster bm on bm.Brand_id = mm.Brand_id_fk join categorymaster cm on cm.Cat_ID = bm.Cat_id_fk where  cm.Cat_id ='" + ItemTypeCellValue + "' and bm.Brand_id = '" + ItemNameCellValue + "' and mm.Model_name like '" + ItemModelCell + "';", con);
                    MySqlDataReader dr4 = cmd3.ExecuteReader();
                    int ItemModelCellValue = 0;
                    while (dr4.Read())
                    {
                        ItemModelCellValue = Convert.ToInt32(dr4["Model_id"]);
                    }
                    Console.WriteLine(ItemModelCellValue);
                    dr4.Close();
                    //MySqlCommand cmd1 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "', '" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "', +'" + a + "' ;", con);

                    MySqlCommand cmd4= new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,Cat_ID_FK,Brand_id_fk,Model_id_fk, po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "','" + ItemTypeCellValue + "','" + ItemNameCellValue + "','" + ItemModelCellValue + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "','" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "' , +'" + a + "' ;", con);
                     cmd4.ExecuteNonQuery();

                }
            }
            catch  (Exception ex)
            {
                throw ex;
            }

        }

What I have tried:

>> Looks like data type error but not sure. I am using var as data type which will allow complier to convert it to best suitable data type based on the input the variable holds.

Posted 3-Sep-22 7:14am

Sameer Farooqui

Updated 4-Sep-22 11:01am

PIEBALDconsult

v2

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Michael_Davies · Answer 1 · 2022-09-03T08:00:00

Hi,

It would be easier to debug if you used parameters instead of constructing strings for your SQL.

This part looks odd;

expected_date + "' , +'" + a + "' ;

Not sure if the + is meant to be there within the SQL unless you are adding contents of a to the contents of expected_date.

Partial code using parameters;

cmd4="

insert into pomaster(po_id,vendor_id_fk, ...etc.) values(@poid,@vendorid,1,SYSDATE(),@companyid ...etc. ", con);

cmd4.Parameters.AddWithValue("@poid", POID);
cmd4.Parameters.AddWithValue("@vendorid", vendorid);
cmd4.Parameters.AddWithValue("@companyid", companyid);
...etc.

OriginalGriff · Answer 2 · 2022-09-03T11:12:00

To add to what Michael_Davies has said ...

Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

SQL

DROP TABLE MyTable;

A perfectly valid "delete the table" command

SQL

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

.net core database insertion error

2 solutions

Solution 1

Solution 2

Add your solution here

Preview 0