C# Syntax Error - INSERT INTO statement. Access Database.

Question

This is my code which I am getting syntax error in my INSERT statement for:

string strSql = "INSERT INTO Responses (OCR, DeadlineDate, OCR Title) VALUES ('"+textBox5.Text+"','"+textBox7.Text+"', '"+textBox6.Text+"')";

OleDbConnection newConn = new OleDbConnection(strProvider);
OleDbCommand dbCmd = new OleDbCommand(strSql, newConn);

newConn.Open();
dbCmd.ExecuteNonQuery();

any ideas?

Avoid your current injection vulnerability; stackoverflow.com/questions/5893837/… — Alex K.
– Alex K., Commented Jan 9, 2014 at 14:11

Mahmoud Gamal · Accepted Answer · 2014-01-09 14:17:30Z

9

The column name OCR Title is invalid, you have to escape it using [] like [OCR Title]:

INSERT INTO Responses (OCR, DeadlineDate, [OCR Title]) VALUES( ...

Also, please try to use parametrized queries instead of concatenating the values:

string strSql = "INSERT INTO Responses (OCR, DeadlineDate, [OCR Title]) VALUES (?, ?, ?)";

using (OleDbConnection newConn = new OleDbConnection(strProvider))
{
  using (OleDbCommand dbCmd = new OleDbCommand(strSql, newConn))
  {
    dbCmd.CommandType = CommandType.Text;
    dbCmd.Parameters.AddWithValue("OCR", textBox5.Text);
    dbCmd.Parameters.AddWithValue("DeadlineDate", textBox7.Text);
    dbCmd.Parameters.AddWithValue("[OCR Title]", textBox6.Text);
    newConn .Open();
    dbCmd.ExecuteNonQuery();
  }
}

edited Jan 9, 2014 at 14:17

answered Jan 9, 2014 at 14:07

Mahmoud Gamal

80.2k18 gold badges143 silver badges168 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Silvermind Over a year ago

Better to always put brackets around column names, when upgrading to a new database version who knows whether e.g. OCR becomes a keyword.

Francesco Milani · Accepted Answer · 2014-01-09 14:12:23Z

0

I guess the syntax error isn't related to c# but to SQL statement.

Maybe you need escape on textBoxes values and text qualifier for "OCR Title" table name.

answered Jan 9, 2014 at 14:12

Francesco Milani

4034 silver badges12 bronze badges

Collectives™ on Stack Overflow

C# Syntax Error - INSERT INTO statement. Access Database.

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related