Insert string into database

[Guest]

hi,

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
.............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

thank you,
Monica

 

[not_a_commie]

string FirstName = "Monica";

string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

how about this:

strCommand = string.Format("INSERT INTO Profiles (FirstName,
LastName) VALUES ('%s', '%s')", FirstName, Number);

That's assuming your Number field is really a string field.

 

[justin creasy]

hi,

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

thank you,
Monica

I think you want to try this command string

strCommand = "INSERT INTO Profiles (FirstName, LastName) Values (" +
FirstName + ", " + Number + ")";

I think this will solve your problem but to be sure I would need to
know a little about the design of the table and more of your source
code (connection string, connecting, etc.). Try posting some code
information if it doesn't work.

 

[Jon Skeet [C# MVP]]

how can I solve this problem? should I write some code or this is provided
by Microsoft?

string FirstName = "Monica";
string Number = "123456789";

strCommand = "INSERT INTO Profiles (FirstName, LastName) " +
"VALUES (FirstName, Number)";
............................................

thisCommand.ExecuteNonQuery();

there are some problem in strCommand. please tell me what's the problem.

You should write this as a parameterised command, and add the parameter
values to the command. That way you avoid SQL injection attacks.

See http://pobox.com/~skeet/csharp/faq/#db.parameters