'Syntax error in INSERT INTO statement.' Cannot insert data into database [duplicate]

Question

I am creating a register form for a program however i cannot get the username and password to save into the microsoft access database. I do not see where i am going wrong with my code, i keep getting 'Syntax error in INSERT INTO statement.' Here is my code...

    Dim sql As String = "INSERT INTO Users (username, password) VALUES (" & Me.Usernametxtb.Text & "','" & Me.Passwordtxtb.Text & "')"

        Dim cms As New OleDbCommand(sql, conn)
        cms.Parameters.AddWithValue("@username", Usernametxtb.Text)
        cms.Parameters.AddWithValue("@password", Passwordtxtb.Text)
        cms.ExecuteNonQuery()

You are inserting the values directly in your query without an opening single quote. You probably meant to do something like this INSERT INTO Users (username, password) VALUES (@username, @password) (Might be different. You don't show what language you are using or anything.) — Ivar
– Ivar, Commented May 12, 2018 at 9:48
i've created a form using vb.net, i'm taking the values of the username and password directly from a textbox displayed on the form which the user fills out — Maidah Arshad
– Maidah Arshad, Commented May 12, 2018 at 9:59

Tom W · Accepted Answer · 2018-05-12 10:16:36Z

1

You are adding parameters, but your statement is not parameterised. Without referencing those parameters in the SQL statement using @username, they aren't used anywhere. The first line is still vulnerable to SQL injection because you're concatenating raw user input.

Also, do not store passwords in plaintext, ever.

answered May 12, 2018 at 10:16

Tom W

5,4814 gold badges33 silver badges58 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Daniel Manta Over a year ago

Apart from what you mention, OP is adding single quotation marks around parameter values in his query. I don't know if this is correct (code samples I've found don't include any) but if it was, still wouldn't work as there is a missing quotation mark before first parameter value.

Gustav · Accepted Answer · 2018-05-12 10:26:47Z

1

And Password is a reserved word in Access, so try:

Dim sql As String = "INSERT INTO Users (username, [password]) VALUES (@username, @password)"

Dim cms As New OleDbCommand(sql, conn)
cms.Parameters.AddWithValue("@username", Usernametxtb.Text)
cms.Parameters.AddWithValue("@password", Passwordtxtb.Text)
cms.ExecuteNonQuery()

answered May 12, 2018 at 10:26

Gustav

56.3k7 gold badges33 silver badges65 bronze badges

Collectives™ on Stack Overflow

'Syntax error in INSERT INTO statement.' Cannot insert data into database [duplicate]

2 Answers 2

1 Comment

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Linked

Related