Click here to Skip to main content
15,896,522 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
getting error in insert query while inserting valuethrough textbox..

//code
C#
string firstname = txt_first_name.Text.Trim();
        string middlename = txt_middle_name.Text.Trim();
        string lastname = txt_last_name.Text.Trim();
        string address = txt_address.Text.Trim();
        string Mobile_No = txt_mob_no.Text.Trim();
        string birthdate = Convert.ToString(txt_birthdate.Text.Trim());
        string gender = Rdo_gender.SelectedIndex.Trim();
        string email_id = txt_email.Text.Trim();
        string user_name = txt_userid.Text.Trim();
        string password  = txt_pass.Text.Trim();
        string confirm_password = txt_confirm_pass.Text.Trim();
        string country = txt_country.Text.Trim();
        string  city = txt_city.Text.Trim();

//getting error in below query

        string querystr= "insert into DSProfile.HDR_PROFILE(first_name, middle_name,last_name , address , contact_number, birth_date, gender, email_id, user_name , password , confirm_password ,country , city)" + " values
        ('" + firstname + "','" + middlename + "', '"+lastname+"','"+ address +"','"+ Mobile_No+"','"+birthdate+"','"+gender+"','"+ email_id+"','"+user_name+"', '"+password+"','"+ confirm_password+"', '"+ country+"','"+ city+"')";
Posted
Updated 8-Nov-12 1:58am
v4
Comments
Can you show that query and respected values, which you are inserting ?
Richard MacCutchan 8-Nov-12 7:54am    
Don't do it this way; use proper parameterised commands. This is a classic example of bad practice.
Member 9579525 8-Nov-12 7:59am    
thank u...tell me example
Richard MacCutchan 8-Nov-12 8:08am    
Read the SQL reference. See also this article for introduction.
fjdiewornncalwe 8-Nov-12 9:05am    
Take the time to learn parameterised commands as Richard suggests. The reason is that your query as it stands if vulnerable to sql injection of the worst kind. Parameterised commands help to mitigate that risk.

1 solution

You need to check if any of the value in entered in the textbox contains ' character if it does, you have to replace it wiht ''.

Though as Richard said, this is not the way you should do it. Ideally you should write SP and pass this all as parameter.
Milind
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900