Click here to Skip to main content
15,903,854 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
While inserting data, I am encountring following error:
MySql.Data.MySqlClient.MySqlException: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1'\

ignore the SQL injection part for now.

Any help would be much appreciated!!!

C#
private void SaveData(string s)

        {


            var company = comboBox1.Text.ToString();
            int companyid = Convert.ToInt32(comboBox1.SelectedValue);
            var vendor = comboBox2.Text.ToString();
            int vendorid = Convert.ToInt32(comboBox2.SelectedValue);
            var POID = textBox3.Text.ToString();
            var expected_date = dateTimePicker2.Value.ToShortDateString();
            var todaydate = DateTime.Today;
            var itemPaymentNote = comboBox3.Text.ToString();

            try
            {
                MySqlConnection con = new MySqlConnection(ConfigurationManager.AppSettings["RL_InventoryConnection"]);
                if (con.State == ConnectionState.Closed)
                    con.Open();
                MySqlCommand cmd = new MySqlCommand("select * from vendormaster where vendor_id= +'" + vendorid + "' ;", con);
                MySqlDataReader dr1 = cmd.ExecuteReader();


                string VcontName1="", Vcontphone1 = "", Vcontemail1 = "", VcontName2 = "", Vcontphone2 = "" , Vcontemail2 = "";
                while (dr1.Read())
                {

                    VcontName1 = dr1["vendor_contact_Name1"].ToString();
                    Vcontphone1 = dr1["vendor_contact_phone1"].ToString();
                    Vcontemail1 = dr1["vendor_contact_email1"].ToString();

                    VcontName2 = dr1["vendor_contact_Name2"].ToString();
                    Vcontphone2 = dr1["vendor_contact_phone2"].ToString();
                    Vcontemail2 = dr1["vendor_contact_email2"].ToString();
                }

                dr1.Close();
                foreach (DataGridViewRow dr in dataGridView1.Rows)
                {
                    var ItemTypeCell = dr.Cells[0].Value;
                    var ItemNameCell = dr.Cells[1].Value;
                    var ItemModelCell = dr.Cells[2].Value;
                    var DescriptionCell = dr.Cells[3].Value;
                    var QuantityCell = dr.Cells[4].Value;
                    var UnitPriceCell = dr.Cells[5].Value;
                    var OtherNotesCell = dr.Cells[6].Value;
                    var GSTCell = dr.Cells[7].Value;
                    var CGSTCell = dr.Cells[8].Value;
                    var SGSTCell = dr.Cells[9].Value;
                    var ItemTotalCell = dr.Cells[10].Value;
                    Console.WriteLine(s);
                    var a = "N/A";

                    MySqlCommand cmd1 = new MySqlCommand("select * from categorymaster where category_name like '" + ItemTypeCell + "' ;", con);
                    MySqlDataReader dr2 = cmd1.ExecuteReader();
                    int ItemTypeCellValue=0;
                    while (dr2.Read())
                    {
                        ItemTypeCellValue = Convert.ToInt32(dr2["Cat_ID"]);
                    }
                    dr2.Close();


                    MySqlCommand cmd2 = new MySqlCommand("select bm.Brand_id, bm.Cat_id_fk, bm.Brand_name from brandmaster bm join categorymaster cm on cm.Cat_id =bm.Cat_id_fk where cm.Cat_id = " + ItemTypeCellValue + " and bm.Brand_name like '" + ItemNameCell + "' ;", con);
                    MySqlDataReader dr3= cmd2.ExecuteReader();
                    int ItemNameCellValue = 0;
                    while (dr3.Read())
                    {
                        ItemNameCellValue = Convert.ToInt32(dr3["Brand_id"]);
                    }
                    dr3.Close();

                    MySqlCommand cmd3 = new MySqlCommand("select mm.Model_name, mm.Model_id, mm.Brand_id_fk from modelmaster mm join brandmaster bm on bm.Brand_id = mm.Brand_id_fk join categorymaster cm on cm.Cat_ID = bm.Cat_id_fk where  cm.Cat_id ='" + ItemTypeCellValue + "' and bm.Brand_id = '" + ItemNameCellValue + "' and mm.Model_name like '" + ItemModelCell + "';", con);
                    MySqlDataReader dr4 = cmd3.ExecuteReader();
                    int ItemModelCellValue = 0;
                    while (dr4.Read())
                    {
                        ItemModelCellValue = Convert.ToInt32(dr4["Model_id"]);
                    }
                    Console.WriteLine(ItemModelCellValue);
                    dr4.Close();
                    //MySqlCommand cmd1 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "', '" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "', +'" + a + "' ;", con);

                    MySqlCommand cmd4= new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,Cat_ID_FK,Brand_id_fk,Model_id_fk, po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "','" + ItemTypeCellValue + "','" + ItemNameCellValue + "','" + ItemModelCellValue + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "','" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "' , +'" + a + "' ;", con);
                     cmd4.ExecuteNonQuery();

                }
            }
            catch  (Exception ex)
            {
                throw ex;
            }

        }


What I have tried:

>> Looks like data type error but not sure. I am using var as data type which will allow complier to convert it to best suitable data type based on the input the variable holds.
Posted
Updated 4-Sep-22 11:01am
v2

Hi,

It would be easier to debug if you used parameters instead of constructing strings for your SQL.

This part looks odd;

expected_date + "' , +'" + a + "' ;


Not sure if the + is meant to be there within the SQL unless you are adding contents of a to the contents of expected_date.

Partial code using parameters;

cmd4="
insert into pomaster(po_id,vendor_id_fk, ...etc.) values(@poid,@vendorid,1,SYSDATE(),@companyid ...etc. ", con);

cmd4.Parameters.AddWithValue("@poid", POID);
cmd4.Parameters.AddWithValue("@vendorid", vendorid);
cmd4.Parameters.AddWithValue("@companyid", companyid);
...etc.
 
Share this answer
 
To add to what Michael_Davies has said ...

Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900