Click here to Skip to main content
15,914,111 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Dear i m unable to insert in table . here i m using windowform and sql data base .

i use following code :

add user this is connection string :
C#
SqlConnection con = new SqlConnection("Data Source=RIZM9\\SQLEXPRESS; Initial Catalog=DynamicDB; integrated security= true; Timeout=45;");

string qry = "INSERT INTO User (Name,Mobile,EmailId,Gender) VALUES( '" + textBox1.Text + "' , '" + textBox2.Text + "','" + textBox3.Text + "' , '" + genderText + "')";
           
SqlCommand cmd = new SqlCommand(qry, con);
cmd.ExecuteNonQuery();
con.Close();
MessageBox.Show("Inserted Successfully");
this.Hide();


But Value not INserted in table . plz help me how to insert data in window form .
Posted
Updated 27-Jan-14 1:49am
v2
Comments
Richard MacCutchan 27-Jan-14 7:51am    
You are using the wrong method for your SQL command, Google for "bobby tables" and learn how to protect yourself from SQL injection attacks and the loss of your database. You should also add code to check for successful execution/completion of your commands.
Rohit85 27-Jan-14 7:56am    
plz give me suggestion with code how to insert successfully
Karthik_Mahalingam 27-Jan-14 7:58am    
r u getting any error ?
Rohit85 27-Jan-14 8:06am    
Incorrect syntax near the keyword 'User'.
Karthik_Mahalingam 27-Jan-14 8:11am    
check my solution

1 solution

try this
C#
string qry = "INSERT INTO  [dbo].[user] (Name,Mobile,EmailId,Gender) VALUES( '" + textBox1.Text + "' , '" + textBox2.Text + "','" + textBox3.Text + "' , '" + genderText + "')";


Note: be aware of SQL Injection[^]

updated based on thebelow comments:


C#
string qry = "INSERT INTO [dbo].[User] (Name,Mobile,EmailId,Gender) VALUES( @Name,@Mobile,@EmailId,@Gender)";

           SqlCommand cmd = new SqlCommand(qry, con);
           cmd.Parameters.AddWithValue("@Name", textBox1.Text);
           cmd.Parameters.AddWithValue("@Mobile", textBox2.Text);
           cmd.Parameters.AddWithValue("@EmailId", textBox3.Text);
           cmd.Parameters.AddWithValue("@Gender", genderText);
           cmd.ExecuteNonQuery();
 
Share this answer
 
v3
Comments
Richard MacCutchan 27-Jan-14 8:44am    
Don't use string concatenation for SQL commands. See my first comment above.
Rohit85 27-Jan-14 8:58am    
than what should be use here ? i m inserting this for single stand alone software for small uses in personal updates
Richard MacCutchan 27-Jan-14 9:03am    
Use parameterised queries. It will help you to avoid problems in the future, and will also make it much easier to diagnose and fix problems.
Rohit85 27-Jan-14 9:06am    
Dear sir , i m very new for c# development filed . i donot have not more knowledge , plz give me some code help . like examples or sample of code in window froom field and .cs page code
Karthik_Mahalingam 27-Jan-14 9:12am    
Rohit,
check my updated solution.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900