What is wrong?

  • Thread starter Thread starter Adrian
  • Start date Start date
A

Adrian

In the line marked *** "one" etc are not allowed.
Please tell me why and what I should do to make this code work.
Many thanks.
Adrian.

try
{
while (carry_on == true)
{
string one = binR.ReadString();
string two = binR.ReadString();
string three = binR.ReadString();
string four = binR.ReadString().Trim();
string five = binR.ReadString().Trim();
string six = binR.ReadString().Trim();
string seven = filler(binR.ReadString());
string eight = filler(binR.ReadString()).Trim();
string nine = binR.ReadString();

*** string what = "INSERT INTO ledger (date, party, concerns,
invoice, debit, credit, gross, vat, statement)
VALUES (one,two,three,four,five,six,seven,eight,nine)";
SqlCommand task = new SqlCommand(what, conn);
task.Connection.Open();
task.ExecuteNonQuery();
task.Connection.Close();
}
}
catch (Exception err)
{
textBox1.Text = err.Message;
carry_on = false;
}
 
Hi Adrian,

You really can't just put variable names into the string.
At least you should do something like "... VALUES (" + one + ", " + two +
"," ...
And if those are strings you should put ', too.
But, this is usually a bad practice because it favors sql injection. Instead
you should use parametrised statements (see docs on SqlParameter).
 
"But, this is usually a bad practice because it favors sql injection.
Instead
you should use parametrised statements (see docs on SqlParameter)."

Miha,

I have searched for a reference, but couldn't find one.
Know of one?

Regards,
Adrian.
 
Hi Adrian,

Open .net help file, go to Index and type in SqlParameter :-)
Or google around and I guess you'll see many examples.
 
Back
Top