cmd = new SqlCommand("INSERT INTO sms_sentmessages(Mobilefrom,Mobileto,Message,senddate) VALUES('" + str.Substring(0, str.Length - 4).ToString() + "','" + number + "','" + txtmessage.Text.Replace("'", "''").Trim() + "',getdate())", con);
cmd.CommandType = CommandType.Text;
cmd.ExecuteNonQuery();
Add a comment
|
3 Answers
str.Substring(0, str.Length - 4)
and/ or
txtmessage.Text.Replace("'", "''").Trim()
are too large to fit with the column you're trying to insert into.
Comments
Well, presumably you're trying to insert a value into the table and it exceeds the length for the column. You should validate the data before you try to execute the SQL insert.
However, you should also use a parameterized query - currently your code is vulnerable to a SQL injection attack. See the Bobby Tables site for more information. Basically, parameterized SQL allows you to keep the code (SQL) separate from the data (parameters), making your code clearer and preventing SQL injection attacks (assuming you're not also using dynamic SQL).
(Finally, it's not clear why you're calling ToString() on the result of a Substring call...)
Comments
Your data (or possibly a trigger) is too big to fit into the column you are trying to store it.
At least, that's my best guess.
Comments
