Yet another SQL query built by concatenating string fields obtained from user input.
This is a very bad practice; you have to use parameterized queries if you do not want to leave your code opened to SQL Injection attacks.
Something like:
string query = "INSERT INTO Customer (custID, title, firstName, lastName, address1, address2, address3, address4, postCode, phoneNumber, mobileNumber, email, fax) VALUES (@accountNumber, @bxTitle, @bxFirstName, @bxLastName, @bxAddressLine1, @bxAddressLine2, @bxCity, @bxCounty, @bxPostCode, @bxLandlineNumber, @bxMobileNumber, @bxEmailAddress, @bxFaxNumber)";
SqlCommand cmd = new SqlCommand(query, sqlCon);
if (!string.IsNullOrEmpty(txtBxAccountNumber.Text)) {
cmd.Parameters.AddWithValue("@accountNumber", txtBxAccountNumber.Text);
}
else {
throw new ArgumentException("AccountNumber field cannot be empty");
}
int accountNumber;
if (int.TryParse(txtBxAccountNumber.Text, out accountNumber)) {
cmd.Parameters.AddWithValue("@accountNumber", accountNumber);
}
else {
throw new ArgumentException("AccountNumber is not a valid integer value");
}
About SQL Injection Attacks:
SQL injection attack[
^]
Hope this helps.