INSERT INTO error

[omend ferdi]

string sql = string.Format("INSERT INTO tbluser(user,pasw,tanya,jawab)VALUES('{0}','{1}',' {2}','{3}')", TBuser.Text, TBpassword.Text, CBboxpertanyaan.SelectedItem, TBjawaban.Text);
OleDbConnection connect = new OleDbConnection(koneksi);
connect.Open();
OleDbCommand cmd = new OleDbCommand(sql, connect);
cmd.ExecuteNonQuery();



I really sure my syntax is work.
but when i run it, visual studio said that there's syntax error in INSERT INTO statement. What should I do?
please help -__-

[Rabbit]

What's the resulting SQL string look like?

[adriancs]

it receive direct input from textbox.
you might need to filter out the escape character for safe sql string.
for example, if the text from the textbox input contains the symbol of
this

'

or this symbol

;

you'll get an syntax error.
you need to replace

'

with a slash and become this

\'

and replace

CBboxpertanyaan.SelectedItem

with

CBboxpertanyaan.SelectedItem + ""

or

CBboxpertanyaan.SelectedItem.ToString()