Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

enter image description here Now,I created upper that table and in order to test I will give 3 textboxes values as below.

SqlCommand cmd = new SqlCommand
("Insert Into dbo.PrnInf(PrnName, PrnSurName, PrnEgn )     Values 
('"+txtPrnName.Text+", "+txtPrnSurName.Text+","+txtPrnEgn.Text+"')", conn);
cmd.ExecuteNonQuery(); 

However,I'm getting the error in the "cmd.execute".Also,I defined the primary key and identity specification on the primary key. the moral of the story,is it require to fill all tables inside of the database?

Best Regards,

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

BAD PRACTICE ALERT!

You need to delimit each string. Not the whole lot.

Note where the single quotes are:

("Insert Into dbo.PrnInf(PrnName, PrnSurName, PrnEgn )     Values 
('"+txtPrnName.Text+"', '"+txtPrnSurName.Text+"','"+txtPrnEgn.Text+"')", conn);

However, this can lead to SQL Injection. So...

GOOD PRACTICE!

Parameterise your query

SqlCommand cmd = new SqlCommand
    ("Insert Into dbo.PrnInf(PrnName, PrnSurName, PrnEgn )     Values 
    (@PrnName, @PrnSurName, @PrnEgn)", conn);
cmd.Parameters.AddWithValue("@PrnName", txtPrnName.Text);
cmd.Parameters.AddWithValue("@PrnSurName", txtPrnSurName.Text);
cmd.Parameters.AddWithValue("@PrnEgn", txtPrnEgn.Text);
cmd.ExecuteNonQuery();
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.