question on SQL INSERT string

[orked]

hi
i make web application by c#,asp.net
i want to make page that regist in DB
but when i run the project tell me
Incorrect syntax near 'value' i want to now what is the problem
thanks

[amirghaffarie1362]

could u plaese send the code u r using ?

[orked]

 
protected void Button1_Click(object sender, EventArgs e)
    {
        SqlConnection dbCon = new SqlConnection();
        dbCon.ConnectionString = @"Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\db.mdf;Integrated Security=True;User Instance=True";
        dbCon.Open();
        SqlCommand sqlcom = new SqlCommand();
        sqlcom.Connection = dbCon;
        sqlcom.CommandType = CommandType.Text;
        sqlcom.CommandText = sqlcom.CommandText = "insert into client (Name,SSN,Salary)" + "value(@NameTextBox.Text ,@SSNTextBox.Text ,@SalaryTextBox.Text )";
        //sqlcom.CommandText = "insert into client (Name,SSN,Salary)  value  ('" + NameTextBox.Text + "','" + SSNTextBox.Text + "','" + SalaryTextBox.Text + "')";
        SqlDataReader rdrData;
        rdrData = sqlcom.ExecuteReader();
        GridView1.DataSource = rdrData;
        GridView1.DataBind();
    }
 

[amirghaffarie1362]

its not correct
sqlcom.CommandText = sqlcom.CommandText = "insert into client (Name,SSN,Salary)" + "value(@NameTextBox.Text ,@SSNTextBox.Text ,@SalaryTextBox.Text )";

it should be
sqlcom.CommandText = "insert into client (Name,SSN,Salary) value ('" + NameTextBox.Text + "','" + SSNTextBox.Text + "','" + SalaryTextBox.Text + "')";

[orked]

the same error appear,no exchange

[Bassem]

Hi,
don't forget @ to the frist of your string, or could use \ as a scape char.

[Bassem]

Oh i forgot, how did you declare your flieds SSN and Salary in your DB, it may not be suitable with your users inputs.
Consider ControlParameter, is the most suitable to collect data form users without having to worry about many.... .
Have attention to this !

Kind Regards,
Bassem

[Plater]

I think the words is VALUES not VALUE

[orked]

when i write values make another error
and when i remove it the same error appear again

[Bassem]

Yes, it is VALUES and make your correction on that.

[Plater]

The string:

"insert into client (Name,SSN,Salary) values ('" + NameTextBox.Text + "', '" + SSNTextBox.Text + "', '" + SalaryTextBox.Text + "' )"; 
 

Should be of correct format.
Assuming you have a table called "client", that table contains the columns Name - SSN - Salary, they all expect a string type of some sort as a value and that there are no other required columns in the table you are leaving out

[Frinavale]

@amirghaffarie1362
You should not be dynamically creating your SQL command as suggested by amirghaffarie.

You should use parameters instead:

sqlcom.CommandText = "INSERT INTO CLIENT(Name, SSN, Salary)" +
                     "VALUES(@clientName, @clientSSN, @clientSalary)"; 
 
sqlCom.Parameters.Add("@clientName", SqlDbType.VarChar).Value = NameTextBox.Text ;
sqlCom.Parmaeters.Add("@clientSSN", SqlDbType.VarChar).Value = SSNTextBox.Text;
sqlCom.Parameters.Add("@clientSalary",SqlDbType.VarChar).Value = SalaryTextBox.Text;

The reason for using parameters is because the information entered by the user will not be compiled with your SQL command.

If you create your SQL statement without parameters, anything entered by the user will be compiled with your sql command. This could leave you vulnerable to an SQL insertion attack.

When you encounter a new error, please post what the error message says so that we can continue to help you :)

-Frinny

[orked]

Hi,
thanks for all one ,the page run without error,if i face any error ,i will send again

regards
orked