Click here to Skip to main content
15,879,348 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more: , +
I am new to vb.net and I am trying to use a datetime picker in my form.
While inserting date to the sql server in datetime column I am getting an error stating it cannot convert the string to date.

please help me with the right code. Here is the code I am using.


VB
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Dim connection As New SqlConnection()
        connection.ConnectionString = SqlConnectionString
        connection.Open()

        Dim ID_Penerima As String = txtIdPenerima.Text
        Dim Message_HL7 As String = txtMessageHl7.Text


        Dim sqlStatement As String = "insert FROMPenerima(IDPenerima, MessageHL7, Tanggal Penerima) select '" & ID_Penerima & "', '" & Message_HL7 & "', " & DateValue(DateTimePicker1) & ""
        Dim cmd As New SqlCommand(sqlStatement, connection)

        cmd.ExecuteNonQuery()
        connection.Close()

    End Sub
End Class
Posted
Comments
CHill60 16-Mar-15 13:29pm    
The Sql statement doesn't look right to me ... put a breakpoint on Dim cmd As New SqlCommand etc and post what the contents of sqlStatement is.
Richard Deeming 16-Mar-15 13:58pm    
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.
PIEBALDconsult 16-Mar-15 14:13pm    
Use a parameterized statement.

Never use query like this! Use Stored procedure[^] instead!

See:
Configuring Parameters and Parameter Data Types[^] - at the bottom of page you'll find complete code.
Walkthrough: Using Only Stored Procedures (Visual Basic)[^] - linq to sql example

By The Way, the proper INSERT[^] statement should looks like:
SQL
INSERT INTO Penerima (IDPenerima, MessageHL7, [Tanggal Penerima])
VALUES ('StringID', 'Message', 'DateValue')
 
Share this answer
 
v2
Comments
[no name] 16-Mar-15 14:18pm    
Uh, oh, Maciej... Stored Procedures? And I thought we could be friends :-p
Just kidding. But I HATE EM ;-)
- Sebastian
Fixing the SQL Injection[^] vulnerability in your code will also fix the error message:
VB.NET
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
    Using connection As New SqlConnection(SqlConnectionString)
        Using cmd As New SqlCommand("INSERT FROMPenerima (IDPenerima, MessageHL7, [Tanggal Penerima]) VALUES (@IDPenerima, @MessageHL7, @TanggalPenerima)", connection)
            
            cmd.Parameters.AddWithValue("@IDPenerima", txtIdPenerima.Text)
            cmd.Parameters.AddWithValue("@MessageHL7", txtMessageHl7.Text)
            cmd.Parameters.AddWithValue("@TanggalPenerima", DateValue(DateTimePicker1))
            
            connection.Open()
            cmd.ExecuteNonQuery()
        End Using
    End Using
End Sub
 
Share this answer
 
A plain insert-statement (a good-practise one) looks like this:
SQL
INSERT INTO table_name (column1,column2,column3,...) VALUES (value1,value2,value3,...);

One important thing is completely missing from your code: Sql-Parameters[^]. They're good for various reasons: Avoiding so-called Sql-Injection-Attacks, avoiding "strange" Sql-Syntax-Errors and making your Sql-Statements better readable and maintainable. Use them right away and you'll (probably ;)) never have troubles with that.

Sql-Parameters are "something like variables" in your Sql-Statements. And in case of Sql-Server you prefix them with an @

Example:
SQL
INSERT INTO Penerima (IDPenerima, MessageHL7, [Tanggal Penerima]) VALUES (@id, @msg, @tp);

To "deliver" the desired values of these parameters along with your Sql-Insert-Statement to the Sql-Server you have to create instances of SqlParameters and add them to the Parameter-Collection of your SqlCommand-Object (also note I left out the "DateValue(..)" and added ".Value" to your DateTimePicker to avoid the error you experienced):
VB
Dim cmd As New SqlCommand(sqlStatement, connection)
cmd.Parameters.AddWithValue("@id", ID_Penerima)
cmd.Parameters.AddWithValue("@msg", Message_HL7)
cmd.Parameters.AddWithValue("@tp", DateTimePicker1.Value)

Finally, to make it good practise (at least as much as I can think of right now), wrap it all into a Try-Catch-Finally[^] (just that we don't need the Catch-Part here) which will ensure that your connection always gets properly closed even if there should an exception be thrown between opening and closing it:
VB
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
    Dim connection As New SqlConnection()
    connection.ConnectionString = SqlConnectionString
    connection.Open()

    Try
        Dim sqlStatement As String = "INSERT INTO Penerima (IDPenerima, MessageHL7, [Tanggal Penerima]) VALUES (@id, @msg, @tp);"

        Dim cmd As New SqlCommand(sqlStatement, connection)

        cmd.Parameters.AddWithValue("@id", txtIdPenerima.Text)
        cmd.Parameters.AddWithValue("@msg", txtMessageHl7.Text)
        cmd.Parameters.AddWithValue("@tp", DateTimePicker1.Value)

        cmd.ExecuteNonQuery()
    Finally
        connection.Close()
    End Try
End Sub


And one tip: Visual Studio 2013 Community Edition is way better than VS2010 (at least if you don't have 2010 Ultimate and especially if you have 2010 Express) and it's FREE! :) Download it here: https://www.visualstudio.com/en-us/products/visual-studio-community-vs.aspx[^]

Edit: If there should be syntax-errors in the code (I'm unexperienced with VB but tried my best) please tell if you can't fix it yourself and I will try to help.
 
Share this answer
 
v5

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900