Click here to Skip to main content
15,888,610 members
Please Sign up or sign in to vote.
1.20/5 (2 votes)
See more:
I am getting a "syntax error in insert into statement" an OleDbException when i am trying the below code...

What I have tried:

protected void Button2_Click(object sender, EventArgs e)
{
string date = Convert.ToDateTime(Label10.Text).ToShortDateString();
long imei = Convert.ToInt64(TextBox3.Text);
int price = Convert.ToInt32(Label13.Text);
int discount = Convert.ToInt32(DropDownList1.SelectedValue);
int totalamt = Convert.ToInt32(Label19.Text);

string constr = "provider= microsoft.jet.oledb.4.0;data source=|datadirectory|mobishop.mdb";
OleDbConnection con = new OleDbConnection(constr);
con.Open();
string sql = "insert into bill(fname, lname, date, IMEIno, coname, mname, color, price, discount, totalamt) values ('" + TextBox1.Text + "', '" + TextBox2.Text + "', '" + Label10.Text + "', '" + TextBox3.Text + "', '" + Label11.Text + "', '" + Label12.Text + "', '" + Label20.Text + "','" + Label13.Text + "','" + DropDownList1.SelectedValue + "', '" + Label19.Text + "')";
OleDbCommand cmd = new OleDbCommand(sql, con);
/*cmd.Parameters.AddWithValue("@fname", TextBox1.Text);
cmd.Parameters.AddWithValue("@lname", TextBox2.Text);
cmd.Parameters.AddWithValue("@date", date);
cmd.Parameters.AddWithValue("@IMEIno", imei);
cmd.Parameters.AddWithValue("@coname", Label11.Text);
cmd.Parameters.AddWithValue("@mname", Label12.Text);
cmd.Parameters.AddWithValue("@color", Label20.Text);
cmd.Parameters.AddWithValue("@price", price);
cmd.Parameters.AddWithValue("@discount", discount);
cmd.Parameters.AddWithValue("@totalamt", totalamt);*/
cmd.ExecuteNonQuery();

string sql2 = "delete * from model where IMEIno='" + TextBox3.Text + "'";
OleDbCommand cmd2 = new OleDbCommand(sql2, con);
cmd2.ExecuteNonQuery();
}
Posted
Updated 26-Apr-17 22:20pm

Don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
Fixing that will also get rid of your problem:
C#
string sql = "insert into bill(fname, lname, date, IMEIno, coname, mname, color, price, discount, totalamt) values (@fname, @lname, @date, @IMEIno, @coName, @mname, @color, @price, @discount, @totalamt)";
Do the same with your DELETE statement, and check everywhere else in your app: if you leave one concatenation in, someone will destroy your DB...

BTW: Do yourself a favour, and stop using Visual Studio default names for everything - you may remember that "TextBox8" is the mobile number today, but when you have to modify it in three weeks time, will you then? Use descriptive names - "tbMobileNo" for example - and your code becomes easier to read, more self documenting, easier to maintain - and surprisingly quicker to code because Intellisense can get to to "tbMobile" in three keystrokes, where "TextBox8" takes thinking about and 8 keystrokes...
 
Share this answer
 
Never build an SQL query by concatenating with user inputs, it is named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability.
SQL injection - Wikipedia[^]
SQL Injection[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900