C# connection with SQL

Question

[WebMethod] 
public void RegisterStudent(string Name, string Gender, int Marks)        
{            
    string connectionString = 
           "Data Source =SAJID-PC\\SQLEXPRESS;Initial Catalog=Design;Integrated Security=True";             
    SqlConnection con = new SqlConnection(connectionString);             
    con.Open();             
    String query = "INSERT INTO Students VALUES + ('" + Name + "', '" + Gender + "'," + Marks + ")";             
    SqlCommand sqlcom = new SqlCommand(query, con);
    sqlcom.ExecuteNonQuery();  
    con.Close();
}

I get this error when I invoke the method:

System.Data.SqlClient.SqlException: Incorrect syntax near '+'. at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action1 wrapCloseInAction) at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection, Action1 wrapCloseInAction) at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) at System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) at System.Data.SqlClient.SqlCommand.ExecuteNonQuery() at Assignment4Web.StudentService.RegisterStudent(String Name, String Gender, Int32 Marks) in c:\users\sajid\documents\visual studio 2010\Projects\Assignment4Web\Assignment4Web\StudentService.asmx.cs:line 56

Salah Akbari · Accepted Answer · 2015-12-06 17:39:48Z

3

Remove unnecessary + after Values and add ' around Marks like this:

String query = "INSERT INTO Students VALUES ('" + Name + "', '" + Gender + "','" + Marks + "')";

Although you should always use parameterized queries to avoid SQL Injection. Something like this:

SqlCommand sqlcom = new SqlCommand("INSERT INTO Students VALUES(@Name ,@Gender,@Marks");
cmd.Parameters.AddWithValue("@Name",Name);
cmd.Parameters.AddWithValue("@Gender",Gender);
cmd.Parameters.AddWithValue("@Marks",Marks);

edited Dec 6, 2015 at 17:39

answered Dec 6, 2015 at 10:30

Salah Akbari

40k10 gold badges85 silver badges115 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

C# connection with SQL

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related