SQL Server insert

Question

I have a simple two-field form that stores its data in the database. For some reason, it isn't working. I have verified that the connection string works, as it is used in another project I made.

I didn't include the beginning of the first class or its page load.

Code:

    protected void btnSubmit_Click(object sender, EventArgs e)
    {
        string Name = txtName.Text;
        string Description = txtSpecial.Text;
        string method = string.Format(
            "INSERT INTO RbSpecials (Name,Description,Active) VALUES ('{0}','{1}','1')",
            Name,
            Description);
        RbConfiguration mySql = new RbConfiguration();
        try
        {
            mySql.Sql_Connection(method);
        }
        catch
        {

        }
    }
}

public class RbConfiguration
{
    string DbConnectionString = "System.Configuration.ConfigurationManager.ConnectionStrings['RBConnectionString'].ConnectionString";

    public void Sql_Connection(string queryString)
    {
        SqlConnection conn = new SqlConnection(DbConnectionString);
        SqlCommand cmd = new SqlCommand(queryString, conn);
        conn.Open();

        conn.Close();
    }
}

It actually didn't produce an error, when I went to look in the table there was no inserted values. Come to find out, the connection string was enclosed in quotes and I didn't use ExecuteNonQuery() — The Muffin Man
– The Muffin Man, Commented Aug 30, 2010 at 23:13
Not answering your question, but your code is vulnerable to SQL injection, which is very dangerous. Google it up, and start using parameterized queries. — A-K
– A-K, Commented Aug 31, 2010 at 1:46

Peter Mortensen · Accepted Answer · 2012-03-17 09:40:41Z

5

You never execute your SQL command:

conn.Open(); 
cmd.ExecuteNonQuery(); 
conn.Close();

And your connection string is wrong (ditch the double quotes):

string DbConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["RBConnectionString"].ConnectionString;

edited Mar 17, 2012 at 9:40

Peter Mortensen

31.4k22 gold badges110 silver badges134 bronze badges

answered Aug 30, 2010 at 23:06

Adam Sills

17.1k6 gold badges54 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

The Muffin Man Over a year ago

thanks, after fixing the connection string and executing the nonquery it works perfectly!

Jesper Fyhr Knudsen · Accepted Answer · 2010-08-30 23:11:26Z

2

Well without knowing the error, I'll give it a shot anyway.

string DbConnectionString = "System.Configuration.ConfigurationManager.ConnectionStrings['RBConnectionString'].ConnectionString";

Should be

string DbConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["RBConnectionString"].ConnectionString;

And as Adam says, you never actually execute your Query. The Sql_Connection-method, only opens a connection, and then closes it again, without actually doing anything.

Try this instead:

public void Sql_Connection(string queryString)
{
    using( SqlConnection conn = new SqlConnection(DbConnectionString) )
    {
        SqlCommand cmd = new SqlCommand(queryString, conn);
        conn.Open();
        cmd.ExecuteNonQuery();
    }
}

edited Aug 30, 2010 at 23:11

answered Aug 30, 2010 at 23:06

Jesper Fyhr Knudsen

7,9872 gold badges37 silver badges46 bronze badges

2 Comments

The Muffin Man Over a year ago

ahhh yes you are right. Also I noticed that the name in brackets needs to be in " " not ' '.

Jesper Fyhr Knudsen Over a year ago

@Nick, ah yes in my haste I didn't notice that :)

Azhar · Accepted Answer · 2010-08-31 04:07:03Z

0

Check your connection string code must not be a string its class which is getting connection string from web.config, so it should be like this

string DbConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["RBConnectionString"].ConnectionString;
You did not execute your SQlCommand, so will it insert the data, do this

conn.Open();

cmd.ExecuteNonQuery();

conn.Close();
its not the cause but the best practice to not to make your code vulnerable to SQLINjection, try this article

How To: Protect From SQL Injection in ASP.NET

answered Aug 31, 2010 at 4:07

Azhar

20.7k39 gold badges149 silver badges211 bronze badges

Collectives™ on Stack Overflow

SQL Server insert

3 Answers 3

1 Comment

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related