Click here to Skip to main content
15,892,059 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
private void button_Pass_Click(object sender, EventArgs e)
        {
            SqlConnection con1 = new SqlConnection("Data Source=JAYI-PC\\SQLEXPRESS;Initial Catalog=db-ub;Integrated Security=True");
            con1.Open();
            Image img = pictureBox_UB.Image;
            byte[] arr;
            ImageConverter converter = new ImageConverter();
            arr = (byte[])converter.ConvertTo(img, typeof(byte[]));
            //SqlCommand cmd1 = new SqlCommand("Insert into Visitors (Image) values('"+arr+"')");
            //cmd1.ExecuteNonQuery();

            string s = "";
            if (comboBox_TOWHOM.SelectedIndex >= 0)
            s = comboBox_TOWHOM.Items[comboBox_TOWHOM.SelectedIndex].ToString();

            string c = "";
            if (comboBox_color.SelectedIndex >= 0)
            c = comboBox_color.Items[comboBox_color.SelectedIndex].ToString();

            string n = "";
            if(numericUpDown_Person.Value >= 0)
            n = numericUpDown_Person.Value.ToString();

            string prps = string.Empty;
            if(radioButton_OFFICIAL.Checked)
            {
                prps = "Official";
            }
            else if(radioButton_PERSONAL.Checked)
            {
                prps = "Personal";
            }

            SqlCommand cmd1 = new SqlCommand("Insert into Visitors(Id,Visitor Name,Organisation Name,Phone No,No of Person,Whom to Visit,Purpose,Color Code,Day In,Time In, Image)values("+textBox_Id.Text+",'" + textBox_NameV.Text + "','" + textBox_Org.Text + "'," + textBox_Phn.Text + ",'" + n + "','" + s + "','" + prps + "','" + c + "','" + textBox_Dayin.Text + "','" + textBox_timeR.Text + "'," + arr + ")",con1);
            cmd1.ExecuteNonQuery();
            MessageBox.Show("Record has been inserted");
            con1.Close();
Posted
Comments
virusstorm 16-Jun-15 13:22pm    
Can you clarify "not storing"? Do you get an error message or is the data simply not making it into the database?
ZurdoDev 16-Jun-15 13:27pm    
You have an insert command so assuming that line fires then it will insert or you will get an error.

First off, change your code to use parameters.

String sql = "INSERT INTO Visitors(ID, Visitor, ..) VALUES ("@id, @visitor..."
...
cmd.Parameters.AddWithValue("@id", txtID.Text); // so that you don't have sql injection problems.
...

However, this is a simple problem if you just debug it. Step through each line and you'll see exactly what is happening.

1 solution

For starters, do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead. This also means you don't need to convert numeric values to strings, in order to get SQL to convert them right back again...

Secondly, your image won't store properly even if you did get that working: Why do I get a "Parameter is not valid." exception when I read an image from my database?[^] explains what you are doing wrong with the image, and how to fix it.

Sort out those two, and your problem will likely go away.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900