473,324 Members | 2,246 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,324 software developers and data experts.

insert into

Hi,

How can I insert variables instead of values in the VALUES() part of the
insert into command, i.e.

var1=10;
var2=20;
var3=30

insert into emp_test (emp_no1, emp_no2, emp_no3) VALUES (var1, var2, var3)";

The above does not work.

TIA
Roy

Nov 17 '05 #1
3 1487
Roy Gourgi wrote:
Hi,

How can I insert variables instead of values in the VALUES() part of the
insert into command, i.e.

var1=10;
var2=20;
var3=30

insert into emp_test (emp_no1, emp_no2, emp_no3) VALUES (var1, var2, var3)";

The above does not work.

TIA
Roy


string sqlCommand = "insert into emp_test (emp_no1, emp_no2, emp_no3)";
sqlCommand += " VALUES ";
sqlCommand += "(" + var1 + ", " + var2 + ", " + var3 + ")";

if that gives you trouble (it could depending on what data is in those
variables), you should look at preparing in insert statement before you
actually execute it, then plug in variables just before you execute.

here's an example that would work with MySQL:

MySqlCommand cmd = new MySqlCommand();

cmd.CommandText = "INSERT INTO emp_test () VALUES ";
cmd.CommandText += "(?var1, ?var2, ?var3)";
cmd.Prepare();

cmd.Parameters.Add("?var1", var1);
cmd.Parameters.Add("?var2", var2);
cmd.Parameters.Add("?var3", var3);

cmd.ExecuteNonQuery();
Nov 17 '05 #2
insert into emp_test (emp_no1, emp_no2, emp_no3) VALUES (" + var1.ToString()
+ ", " + var2.ToString() + ", " + var3.ToString() + ")";
"Roy Gourgi" wrote:
Hi,

How can I insert variables instead of values in the VALUES() part of the
insert into command, i.e.

var1=10;
var2=20;
var3=30

insert into emp_test (emp_no1, emp_no2, emp_no3) VALUES (var1, var2, var3)";

The above does not work.

TIA
Roy

Nov 17 '05 #3
Eric <Er**@discussions.microsoft.com> wrote:
insert into emp_test (emp_no1, emp_no2, emp_no3) VALUES (" + var1.ToString()
+ ", " + var2.ToString() + ", " + var3.ToString() + ")";


That leaves you open to a SQL injection attack if var1, var2 or var3
are provided by the user.

Just Say No to embedding values literally into SQL - always use SQL
parameters.

--
Jon Skeet - <sk***@pobox.com>
http://www.pobox.com/~skeet Blog: http://www.msmvps.com/jon.skeet
If replying to the group, please do not mail me too
Nov 17 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

15
by: Jack | last post by:
I have a text file of data in a file (add2db.txt) where the entries are already entered on separate lines in the following form: INSERT INTO `reviews` VALUES("", "Tony's", "Lunch", "Great...
14
by: serge | last post by:
I have a scenario where two tables are in a One-to-Many relationship and I need to move the data from the Many table to the One table so that it becomes a One-to-One relationship. I need to...
16
by: Philip Boonzaaier | last post by:
I want to be able to generate SQL statements that will go through a list of data, effectively row by row, enquire on the database if this exists in the selected table- If it exists, then the colums...
4
by: Chris Kratz | last post by:
Hello all, We have run into what appears to be a problem with rules and subselects in postgres 7.4.1. We have boiled it down to the following test case. If anyone has any thoughts as to why...
2
by: Geoffrey KRETZ | last post by:
Hello, I'm wondering if the following behaviour is the correct one for PostGreSQL (7.4 on UNIX). I've a table temp_tab with 5 fields (f1,f2,f3,...),and I'm a launching the following request :...
3
by: MP | last post by:
Hi Posted this several hours ago to another ng but it never showed up thought i'd try here. using vb6, ado, .mdb, jet4.0, no access given table tblJob with field JobNumber text(10) 'The...
6
by: lenygold via DBMonster.com | last post by:
Hi everybody: What is the best way to I have 10 tables with similar INSERT requiremnts. INSERT INTO ACSB.VAATAFAE WITH AA(AA_TIN, AA_FILE_SOURCE_CD, .AA_TIN_TYP) AS ( SELECT AA_TIN,...
24
by: Henry J. | last post by:
My app needs to insert thousand value rows into a mostly empty table (data are read from a file). I can either use inserts, or use merge. The advantage of using merge is that in the few cases...
1
by: Mike1961 | last post by:
Hi all. I have problem with this asp code: strSplitDati = Split(request.Form("dati"), ",") for i = LBound(strSplitDati) to (INT(UBound(strSplitDati)/4)-1)*4 step 4 ...
1
by: EJO | last post by:
with sql 2000 enterprise Trying to build a stored procedure that will take the rows of a parent table, insert them into another table as well as the rows from a child table to insert into...
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
by: ryjfgjl | last post by:
ExcelToDatabase: batch import excel into database automatically...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.