Click here to Skip to main content
15,911,039 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi everyone. I am trying to insert values from text-boxes into a table named employee. There are no errors occurring when I execute the query but the values aren't being added. My code is as follows:
private void InsertEmployee()
        {
            string connectionSQL = "server=sql.byethost27.org;user id=xxxxx;password=xxxxx;database=xxxxx";
            MySqlConnection conn = new MySqlConnection(connectionSQL);
            try
            {
                conn.Open();
                MySqlCommand cmd = new MySqlCommand("INSERT INTO Employee (Name,Address,City,State, ZipCode,Phone,Cell,DOB,Email,Start) VALUES ('" + name.Text + "', '" + Address.Text + "', '" + City.Text + "', '" + State.Text + "', '" + ZipCode.Text + "', '" + Phone.Text + "', '" + datePicker1.Text + "', '" + cell.Text + "', '" +Email.Text + "', '" + Start +"')", conn);
                conn.Close();
            }

            catch (MySqlException ex)
            {

                MessageBox.Show("Can't connect to database\n" + ex.ToString());
            }
        }


Any help you can give me would be much appreciated
Many Thanks
Emma
Posted
Updated 1-Apr-13 5:02am
v2
Comments
[no name] 1-Apr-13 11:03am    
Mostly because you are not executing your SQL-injection-attack-waiting-to-happen query.

A couple things:

1. You never call the .ExecuteNonQuery() method to update the database.

2. You are setting yourself up for sql injection attacks. Research parameterized quereis to prevent that.
 
Share this answer
 
1. cmd.ExecuteNonQuery() ; is to be called before closing connection
2. use parameterized query other wise if user puts any , or ' or any sql query then this query will not be formed properly. Using parameter u will prevent Sql Injection attack.
3. Always close and dispose connection in finally block otherwise if there is any exception in cmd.ExecuteNonQuery() the connection will remain open .
 
Share this answer
 
Yeah, what they said. Plus parameters will allow you to avoid passing datePicker1 as Text and use the correct type -- you are storing it in a date aren't you?
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900