Inserting data into database but getting incorrect syntax error

Question

I'm trying to add student data into a database but keeps coming up with the error "incorrect syntax near the keyword 'Table'". I'm very new to using windows form does anybody know where I have gone wrong?

private void BTAddstudent_Click(object sender, EventArgs e)
{
    try
    {
        string myconnection = @"Data Source = (LocalDB)\MSSQLLocalDB; AttachDbFilename = C:\Users\tayla\OneDrive\Documents\StudentPerformance\StudentPerformance\Studentdatabase.mdf; Integrated Security = True";

        string Query = "Insert Into Table (ID, First name, Last name, Course 1, Course 2, Course 3, Course 4, Course 5, Course 6, Course 7, Course 8, Course 9, Course 10) values('" + this.txtbxID.Text + "','" + this.txtbxfirstname.Text + "','" + this.txtbxlastname.Text + "','" + this.txtbxcourse1.Text
            + "','" + this.txtbxcourse2.Text + "','" + this.txtbxcourse3.Text + "','" + this.txtbxcourse4.Text + "','" + this.txtbxcourse5.Text + "','" + this.txtbxcourse6.Text + "','" + this.txtbxcourse7.Text
            + "','" + this.txtbxcourse8.Text + "','" + this.txtbxcourse9.Text + "','" + this.txtbxcourse10.Text + "')";

        SqlConnection myconn = new SqlConnection(myconnection);
        SqlCommand mycom = new SqlCommand(Query, myconn);
        SqlDataReader reader1;
        myconn.Open();
        reader1 = mycom.ExecuteReader();
        while (reader1.Read()) ;
        {
        }
        myconn.Close();
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message);
    }
}

Use a parameterised query, if you don't know what that is, you need to research it, it will make it easier to spot mistakes, and it will stop sql injection attacks among other things — TheGeneral
– TheGeneral, Commented May 30, 2019 at 3:06
The ten courses may also indicate to rethink your design. Usually there should be another table, where you insert rows for the courses people take. — sticky bit
– sticky bit, Commented May 30, 2019 at 3:26

Han · Accepted Answer · 2019-05-30 03:14:31Z

1

If you named your table Table, you must use brackets because Table is a reserved word. You must also use brackets in your column names if you use spaces.

Your sql statement should be like this:

Insert Into [Table] (ID, [First name], [Last name], [Course 1], [Course 2], ...

Using parameterized query is better. It's easier to read and it prevents SQL injection attack.

answered May 30, 2019 at 3:14

Han

3,0822 gold badges25 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Inserting data into database but getting incorrect syntax error

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related