You are here: Re: error for sending(saving) data to database « MsSQL Server « IT news, forums, messages
Re: error for sending(saving) data to database

Posted by Erland Sommarskog on 02/22/07 22:11

(projectid2007@yahoo.com) writes:
> I'm using VS2005 and I'm trying to link the C# windows form to MSSQL.
> I used BindingNavigator Control to read the data. After that I add
> sqlcommand and sqldataadapter to send the data to the database. My
> code is this
>
> sqlDataAdapter1. InsertCommand. CommandText =
> "INSERT INTO SUDENT (" +
> "S_ID, S_NAME, S_ADDRESS, S_PHONE" +
> ") VALUES ('" +
> S_IDComboBox. Text + "', '" +
> S_NAMETextBox. Text + "', '" +
> S_ADDRESSTextBox. Text + "', '" +
> S_PHONETextBox. Text + "')";

Since you ask this in an SQL Server newsgroup, I will tell you what is
wrong with this query from an SQL Server perspective. What do you think
happens if the user in the PhoneTextBoxs types:

'); DROP TABLE SUDENT'

Oops! Table gone!

You should use parameterised commands:

"INSERT INTO SUDENT (" +
"S_ID, S_NAME, S_ADDRESS, S_PHONE" +
") VALUES (@ID, @Name, @Address, @Phone)"

and then use the CreateParameter method to define your parameters.


> sqlDataAdapter1. InsertCommand. ExecuteNonQuery( );
>
> It gave me this error
> "NulleferenceExcept ion was Unhandled"and " Object refrence not set to
> an instance of an object" so I add this line
>
> sqlCommand1 = ("INSERT INTO STUDENT (S_ID,S_NAME, S_ADDRESS, S_PHONE)
> VALUES (@S_ID,@S_NAME, @S_ADDRESS, @S_PHONE) " ,sqlConnection1) ;
>
> Then it gave me some stupid error. By the way it didn't make a new
> object of SqlCommand although I tired ....
>
> So can u help me to solve my problem ? Thank you

You are probably better off asking in a .Net newsgroup about how to
write .Net programs. Particularly, if you want to link them to
forms.



--
Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

 

Navigation:

[Reply to this message]


Удаленная работа для программистов  •  Как заработать на Google AdSense  •  England, UK  •  статьи на английском  •  PHP MySQL CMS Apache Oscommerce  •  Online Business Knowledge Base  •  DVD MP3 AVI MP4 players codecs conversion help
Home  •  Search  •  Site Map  •  Set as Homepage  •  Add to Favourites

Copyright © 2005-2006 Powered by Custom PHP Programming

Сайт изготовлен в Студии Валентина Петручека
изготовление и поддержка веб-сайтов, разработка программного обеспечения, поисковая оптимизация