A
Andrew Banks
I'm running the following code in a C#.NET page and it doesn't enter the
values into the DB. I'm certain the problem is to do with the txtBirth
field. It allows users to enter a DOB as dd/mm/yyyy and I think it's the
slashes(/) that are causing the problem. If I don't enter a DOB in this
field then all the data enters into the database without a problem.
Any ideas?
SQL Server 2000, VS.NET, C#
if (Page.IsValid)
{
// Save the new user to the database
SqlConnection con;
string sql;
SqlCommand cmd;
StringBuilder sb = new StringBuilder();
ArrayList values = new ArrayList();
sb.Append("INSERT INTO [User] ");
sb.Append("(UserID, Login, Password, FirstName, LastName, ");
sb.Append("PhoneNumber, Email, IsAdministrator, Address, ");
sb.Append("CellNumber, DateOfBirth) ");
sb.Append("VALUES ('{0}', '{1}', '{2}', '{3}', '{4}', '{5}', '{6}', '{7}',
");
// Optional values without quotes as they can be null
sb.Append("{8}, {9}, {10})");
// Add required values to replace
values.Add(Guid.NewGuid().ToString());
values.Add(txtLogin.Text);
values.Add(txtPwd.Text);
values.Add(txtFName.Text);
values.Add(txtLName.Text);
values.Add(txtPhone.Text);
values.Add(txtEmail.Text);
values.Add(0);
// Add the optional values or Null
if (txtAddress.Text != string.Empty)
values.Add("'" + txtAddress.Text + "'");
else
values.Add("Null");
if (txtMobile.Text != string.Empty)
values.Add("'" + txtMobile.Text + "'");
else
values.Add("Null");
if (txtBirth.Text != string.Empty)
values.Add("'" + txtBirth.Text + "'");
else
values.Add("Null");
// Format the string with the array of values
sql = String.Format(sb.ToString(), values.ToArray());
// Connect and execute the SQL
con = new SqlConnection("data source=127.0.0.1;initial catalog=Friends; user
id=sa;");
cmd = new SqlCommand(sql, con);
con.Open();
bool doredirect=true;
try
{
cmd.ExecuteNonQuery();
}
catch
{
doredirect = false;
this.lblMessage.Visible = true;
//this.lblMessage.Text = "Insert couldn't be performed. Username may already
be taken.";
this.lblMessage.Text = sql;
}
finally
{
con.Close();
}
if (doredirect)
Response.Redirect("Login.aspx");
}
else
lblMessage.Text = "Fix the following errors and retry:";
}
values into the DB. I'm certain the problem is to do with the txtBirth
field. It allows users to enter a DOB as dd/mm/yyyy and I think it's the
slashes(/) that are causing the problem. If I don't enter a DOB in this
field then all the data enters into the database without a problem.
Any ideas?
SQL Server 2000, VS.NET, C#
if (Page.IsValid)
{
// Save the new user to the database
SqlConnection con;
string sql;
SqlCommand cmd;
StringBuilder sb = new StringBuilder();
ArrayList values = new ArrayList();
sb.Append("INSERT INTO [User] ");
sb.Append("(UserID, Login, Password, FirstName, LastName, ");
sb.Append("PhoneNumber, Email, IsAdministrator, Address, ");
sb.Append("CellNumber, DateOfBirth) ");
sb.Append("VALUES ('{0}', '{1}', '{2}', '{3}', '{4}', '{5}', '{6}', '{7}',
");
// Optional values without quotes as they can be null
sb.Append("{8}, {9}, {10})");
// Add required values to replace
values.Add(Guid.NewGuid().ToString());
values.Add(txtLogin.Text);
values.Add(txtPwd.Text);
values.Add(txtFName.Text);
values.Add(txtLName.Text);
values.Add(txtPhone.Text);
values.Add(txtEmail.Text);
values.Add(0);
// Add the optional values or Null
if (txtAddress.Text != string.Empty)
values.Add("'" + txtAddress.Text + "'");
else
values.Add("Null");
if (txtMobile.Text != string.Empty)
values.Add("'" + txtMobile.Text + "'");
else
values.Add("Null");
if (txtBirth.Text != string.Empty)
values.Add("'" + txtBirth.Text + "'");
else
values.Add("Null");
// Format the string with the array of values
sql = String.Format(sb.ToString(), values.ToArray());
// Connect and execute the SQL
con = new SqlConnection("data source=127.0.0.1;initial catalog=Friends; user
id=sa;");
cmd = new SqlCommand(sql, con);
con.Open();
bool doredirect=true;
try
{
cmd.ExecuteNonQuery();
}
catch
{
doredirect = false;
this.lblMessage.Visible = true;
//this.lblMessage.Text = "Insert couldn't be performed. Username may already
be taken.";
this.lblMessage.Text = sql;
}
finally
{
con.Close();
}
if (doredirect)
Response.Redirect("Login.aspx");
}
else
lblMessage.Text = "Fix the following errors and retry:";
}