Insert string into database

[=?Utf-8?B?TW9uaWNh?=]

hi,

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
.............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

thank you,
Monica

[not_a_commie]

string FirstName = "Monica";

string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

how about this:

strCommand = string.Format("INSERT INTO Profiles (FirstName,
LastName) VALUES ('%s', '%s')", FirstName, Number);

That's assuming your Number field is really a string field.

[justin creasy]

On Mar 1, 7:46 pm, Monica <[e-mail]:

hi,

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

thank you,
Monica

I think you want to try this command string

strCommand = "INSERT INTO Profiles (FirstName, LastName) Values (" +
FirstName + ", " + Number + ")";

I think this will solve your problem but to be sure I would need to
know a little about the design of the table and more of your source
code (connection string, connecting, etc.). Try posting some code
information if it doesn't work.

[Jon Skeet [C# MVP]]

Monica <Mo****@discussions.microsoft.comwrote:

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

You should write this as a parameterised command, and add the parameter
values to the command. That way you avoid SQL injection attacks.

See http://pobox.com/~skeet/csharp/faq/#db.parameters

--
Jon Skeet - <sk***@pobox.com>
http://www.pobox.com/~skeet Blog: http://www.msmvps.com/jon.skeet
If replying to the group, please do not mail me too