Click here to Skip to main content
15,891,529 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C#
private void button1_Click(object sender, EventArgs e)
        {
            try
            {
                SqlConnection con = new SqlConnection(@"Data Source=ASUS\SQLEXPRESS;Initial Catalog=E1;Integrated Security=True;");
                con.Open();
               // string str = "CREATE TABLE'"+textBox1.Text+"(userid number(10),password varchar2(20),email varchar2(20));'";
                string str = "CREATE TABLE " + textBox1.Text + " (dataid varchar(10), data varchar());";
                SqlCommand cmd = new SqlCommand(str, con);
                cmd.ExecuteNonQuery();
                string str1 = "insert into users(userid,password,email) values('" + textBox1.Text + "','" + textBox2.Text + "','" + textBox4.Text + "')";
                SqlCommand cmd1 = new SqlCommand(str1, con);
                cmd1.ExecuteNonQuery();
                MessageBox.Show("Table created");
            }
            catch (Exception ex)
                {
                    MessageBox.Show(ex.Message);
                }
}


What I have tried:

i am trying to run this but when i run it,it says incorrect syntax near '('
Posted
Updated 21-Mar-16 18:35pm
v2
Comments
Anisuzzaman Sumon 21-Mar-16 23:55pm    
string str = "CREATE TABLE " + textBox1.Text + " (dataid varchar(10), data varchar());"; //here you have missed to give the size of varchar(). use varchar(10) instead of varchar()
Arthur V. Ratz 22-Mar-16 0:34am    
+5.
Member 10549697 22-Mar-16 1:20am    
thank you!
Richard Deeming 29-Mar-16 8:23am    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Also, you're storing passwords as plain text. That's an extremely bad idea. You should only ever store a salted hash of the password, using a unique salt per record.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

And creating a separate table for every single user is a ridiculously bad design. Have a single table to store the data, with the user ID as a foreign key.

Change your create table query. It should be:
"CREATE TABLE " + textBox1.Text + " (dataid varchar(10), data varchar(10));";
 
Share this answer
 
v2
Comments
Member 10549697 22-Mar-16 1:20am    
ya exactly..thanks
A wise man would do a google for 'parameterized queries' and not concatentate strings to form a SQL statement - its too easy to get it wrong/mess it up (and its a security risk)
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900