i wrote a connection string in asp.net i.e add 2 data through 2 textboxes into the sql server database . but after pressing submit button i face to an error .
Details:
web.config:
<!--
For more information on how to configure your ASP.NET application, please visit
http://go.microsoft.com/fwlink/?LinkId=169433
-->
<configuration>
<connectionStrings>
<add name="myconectionstring"
connectionString="data source=.\SQLEXPRESS;initial catalogue=test;Integrated Security=SSPI;" providerName="System.Data.SqlClient" />
</connectionStrings>
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
</system.web>
</configuration>
code behind:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
namespace WebApplication3
{
public partial class WebForm1 : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button1_Click1(object sender, EventArgs e)
{
string cs = System.Configuration.ConfigurationManager.ConnectionStrings["myconectionstring"].ConnectionString;
SqlConnection con = new SqlConnection(cs);
try
{
///string cs = System.Configuration.ConfigurationManager.ConnectionStrings["myconectionstring"].ConnectionString;
SqlCommand cmd = new SqlCommand("INSERT INTO Table_1 (name,fathername) VALUES('" + txt1.Text + "','" + txt2.Text + "')", con);
con.Open();
cmd.ExecuteNonQuery();
}
catch (Exception ex)
{
String ErrorMsg = ex.ToString();
}
finally
{
con.Close();
}
}
}
}
Error message :
Server Error in '/' Application.
Keyword not supported: 'initial catalogue'.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.ArgumentException: Keyword not supported: 'initial catalogue'.
Source Error:
Line 21: {
Line 22: string cs = System.Configuration.ConfigurationManager.ConnectionStrings["myconectionstring"].ConnectionString;
Line 23: SqlConnection con = new SqlConnection(cs);
Line 24:
Line 25: try
Source File: c:\Users\Admin\Documents\Visual Studio 2012\Projects\WebApplication3\WebApplication3\WebForm1.aspx.cs Line: 23
Initial Cataloginstead ofInitial CatalogueSqlCommand.Parametersyour code clearly exposed to sql injections.