Click here to Skip to main content
15,891,926 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C#
String typeoftrans = comboBox1_TransactionType.Text.ToString();
           
            String ondate = DateTime.Now.ToString();
            string desc = textBox2_Description.Text.ToString();
            string amnt = textBox3_Amount.Text.ToString();

          try
            {

                con.Open();
                string Sql = "insert into Account_Transactions(TransactionType,Description,Amount,OnDateTime) values('" +typeoftrans+ ",'" + desc + "','" + amnt + "','" + ondate + "')";

                OleDbCommand cmd1 = new OleDbCommand(Sql, con);

                int temp = cmd1.ExecuteNonQuery();
                if (temp > 0)
                {
                    MessageBox.Show("Transaction done!");
                }
                else
                    MessageBox.Show("error");
            }
            catch (Exception e2)
            {
                MessageBox.Show(e2.ToString());
            }
            finally
            {
                con.Close();
            }
Posted

1 solution

First of all! NEVER use string concatenation to create a query - this opens up your application to SQL injection...
The problem is you are not handling right the quotes in your query...
C#
values('" +typeoftrans+ ",'"

You are opening a quote before the value but closing it only after the comma...
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900