Insert data to SQL using C#

Question

I keep on getting the problem

"An unhandled exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll" "on SDA.SelectCommand.ExecuteNonQuery();".

Whats the problem here?

SqlConnection con = new SqlConnection(@"Data Source=LAPTOP-LD5OK96E\SQLEXPRESS;Initial Catalog=TRANSACTION_RATE TABLE; Integrated Security=True");

    private void label1_Click(object sender, EventArgs e)
    {

    }

    private void button1_Click(object sender, EventArgs e)
    {
        con.Open();
        String query = "INSERT INTO TRANSACTION_RATE TABLE (Trans_id,Transaction_type,Transact_rate,Transact_description) VALUES('" + textBox1.Text + "','" + textBox2.Text + "''" + textBox3.Text + "''" + textBox4.Text + "')";
        SqlDataAdapter SDA = new SqlDataAdapter(query, con);
        SDA.SelectCommand.ExecuteNonQuery();
        con.Close();
        MessageBox.Show("Success!");

I'm pretty sure this INSERT INTO TRANSACTION_RATE TABLE is not correct. I guess TABLE is the bit you copy/pasted wrongly but once you fixed that you're still in for lots of trouble if that code ever makes it into production.stackoverflow.com/questions/332365/… — rene
– rene, Commented Apr 28, 2020 at 8:57
You have two separate problems in your question. You should a) Avoid concatenating strings because is a security risk called SQL Injection and b) your "TRANSACTION_RATE TABLE" should be escaped so SQL Server knows what the table name is. Check this related answer — Cleptus
– Cleptus, Commented Apr 28, 2020 at 9:00

Salah Akbari · Accepted Answer · 2020-04-28 11:01:21Z

3

You have one stray TABLE keyword after your table's name, you need to remove it. as a second note, you need to be aware that this kind of string concatenation is avoided and it is open to SQL Injection attack:

String query = "INSERT INTO TRANSACTION_RATE (Trans_id,Transaction_type,Transact_rate,Transact_description) VALUES (@Trans_id, @Transaction_type,@Transact_rate, @Transact_description)";


SDA.SelectCommand.Parameters.Add("@Trans_id", SqlDbType.NVarChar, 50).Value = textBox1.Text;
SDA.SelectCommand.Parameters.Add("@Transaction_type", SqlDbType.NVarChar, 50).Value = textBox2.Text;
SDA.SelectCommand.Parameters.Add("@Transact_rate", SqlDbType.NVarChar, 50).Value = textBox3.Text;
SDA.SelectCommand.Parameters.Add("@Transact_description", SqlDbType.NVarChar, 50).Value = textBox4.Text;

In case your table was named in fact TRANSACTION_RATE TABLE you should escape the name like this:

INSERT INTO [TRANSACTION_RATE TABLE] ....

edited Apr 28, 2020 at 11:01

answered Apr 28, 2020 at 8:57

Salah Akbari

40k10 gold badges85 silver badges115 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

All Mixtape Over a year ago

SIR, IT WORKS!!! What I did was, I rolled back the codes to SqlDataAdapter SDA = new SqlDataAdapter(query, con); and SDA.SelectCommand.ExecuteNonQuery();. After that its done!! I'm very thankful that you are there, you the best sir!

Collectives™ on Stack Overflow

Insert data to SQL using C#

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related