Click here to Skip to main content
15,894,017 members
Please Sign up or sign in to vote.
1.33/5 (2 votes)
See more:
C#
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data;
using System.Data.SqlClient;
namespace studentMS
{
    public partial class Form2 : Form
    {
        public Form2()
        {
            InitializeComponent();
        }
        SqlConnection conn = new SqlConnection("Data Source=TAHIR-PC;Initial Catalog=StudentMS;Integrated Security=True");
        SqlCommand cm;

        private void Form2_Load(object sender, EventArgs e)
        {
         
           

        }

        private void bnt_save_Click(object sender, EventArgs e)
        {
            //string s = "";
            //if (cmb_SCourse.SelectedIndex >= 0)
            //    s = cmb_SCourse.Items[cmb_SCourse.SelectedIndex].ToString();

            try
            {
               
                string sql="Insert into Students(Name,FatherName,address,PhoneNo,Email,Course,Batch,Teacher)values('"+txt_SName.Text+"','"+txt_SFname.Text+"','"+txt_SAddress.Text+"','"+txt_SPhoneNo.Text+"','"+txt_SEmail.Text+"','"+cmb_SCourse.SelectedItem+"','"+cmb_SCourse.SelectedItem+"','"+cmb_Steacher.SelectedItem+"')";
                conn.Open();

                cm = new SqlCommand(sql, conn);
                cm.ExecuteNonQuery();
                conn.Close();
                label1.Visible = true;
                label1.Text = "saved Successfully";
                txt_SAddress.Text = txt_SEmail.Text = txt_SFname.Text = txt_SName.Text = txt_SPhoneNo.Text = "";
            }
            catch(Exception ex)
            {
                label1.Text = ex.Message;
            }
        }
    }
}
Posted
Updated 17-Jul-13 2:57am
v3
Comments
ZurdoDev 17-Jul-13 8:42am    
1) What's your question?
2) I hope this code never is used anywhere. Your entire database can be easily hacked with SQL injections.
[no name] 17-Jul-13 8:49am    
This is just a code dump not a question or description of any kind of a problem.

Blow code will perfectly work for ur program
C#
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data;
using System.Data.SqlClient;
namespace studentMS
{
    public partial class Form2 : Form
    {
        public Form2()
        {
            InitializeComponent();
        }
        SqlConnection conn = new SqlConnection("Data Source=TAHIR-PC;Initial Catalog=StudentMS;Integrated Security=True");
        SqlCommand cm;
 
        private void Form2_Load(object sender, EventArgs e)
        {
         
           
 
        }
 
        private void bnt_save_Click(object sender, EventArgs e)
        {
            //string s = "";
            //if (cmb_SCourse.SelectedIndex >= 0)
            //    s = cmb_SCourse.Items[cmb_SCourse.SelectedIndex].ToString();

            try
            {
               
                string sql="Insert into Students(Name,FatherName,address,PhoneNo,Email,Course,Batch,Teacher)values('"+txt_SName.Text+"','"+txt_SFname.Text+"','"+txt_SAddress.Text+"','"+txt_SPhoneNo.Text+"','"+txt_SEmail.Text+"','"+cmb_SCourse.SelectedItem.text+"','"+cmb_SCourse.SelectedItem.text+"','"+cmb_Steacher.SelectedItem.text+"')";
                conn.Open();
 
                cm = new SqlCommand(sql, conn);
                cm.ExecuteNonQuery();
                conn.Close();
                label1.Visible = true;
                label1.Text = "saved Successfully";
                txt_SAddress.Text = txt_SEmail.Text = txt_SFname.Text = txt_SName.Text = txt_SPhoneNo.Text = "";
            }
            catch(Exception ex)
            {
                label1.Text = ex.Message;
            }
        }
    }
}
 
Share this answer
 
v2
Comments
[no name] 17-Jul-13 10:25am    
If you mean "perfectly work" as in won't compile then you are correct.
If you mean "perfectly work" as in open yourself to SQL injection attacks then you are correct again.
Make
C#
cmb_SCourse.SelectedItem

as
C#
cmb_SCourse.Text
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900