Insert Command With Parameters

[Guest]

All

If I have a SQL statmenet as illistarted below what is the best way to
append parameters to the command.

Dim sql As Text.StringBuilder
sql.Append("INSERT Table ")
sql.Append("(col1, col2) ")
sql.Append("?, ?")

Thanks

 

[Cor Ligthert [MVP]]

David,

The general best does not exist in Net, there is forever a best for your
situation.

However see this page on our website.

http://www.windowsformsdatagridhelp.com/default.aspx?ID=550279ec-6767-44ff-aaa3-eb8b44af0137

I hope this helps,

Cor

 

[Herfried K. Wagner [MVP]]

If I have a SQL statmenet as illistarted below what is the best way to
append parameters to the command.

Dim sql As Text.StringBuilder
sql.Append("INSERT Table ")
sql.Append("(col1, col2) ")
sql.Append("?, ?")

Sample (look for "INSERT INTO"):

..NET Framework Class Library -- 'SqlDataAdapter' Constructor ('SqlCommand')
<URL:http://msdn.microsoft.com/library/e...ataSqlClientSqlDataAdapterClassctorTopic2.asp>

The sample shows how to use a parameterized command. This approach is
recommended over building up the whole command string by hand because it
protects from SQL injection.

 

[Cor Ligthert [MVP]]

Herfried,

You show SQL parameters. The parameters are the only thing that I know which
are different between SQLClient and OleDb.

Showed by the OP is an OleDb SQL Insert string.

That the OP ask this is very good, because it is not that well described on
MSDN.

Cor