Click here to Skip to main content
15,893,588 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
In my c# code is below
C#
cmd = new SqlCommand("insert into login values(" & TextBox1.Text & "," & TextBox2.Text & ")", con);

It is not run. The error occurred. The & is not defines string to string

Any one help me for this problem
Posted
Updated 13-Dec-11 22:06pm
v2
Comments
Al Moje 14-Dec-11 4:09am    
The & is used in vb.net code. Since you are using c#, replace it with +

try:
C#
cmd = new SqlCommand("insert into login values('"+ TextBox1.Text + "','"+ TextBox2.Text+"')", con);

i suggest you practice more for using ADO .Net with .net applications , u can get number of examples surfing google,
please refer the following link this might help you:
http://msdn.microsoft.com/en-us/library/6759sth4%28v=vs.71%29.aspx[^]
 
Share this answer
 
Comments
devausha 14-Dec-11 4:32am    
Thank you for your answer and Suggestions
member60 14-Dec-11 4:47am    
Thank you devausha ,Happy coding.
To add to prabhaamaji's comments, you really shouldn't do it that way anyway.
There are two problems there: one with the SQL syntax, and one called SQL Injection.

While the syntax will work, it depends on the order in which the columns in your database are defined. If someone modifis it and adds a column before the username, then your code fails , becasue it expects the username first. Always name the columns, in the order you are goint to fill them:
SQL
INSERT INTO login (userName, password) VALUES (...)
That way your code is better protected against future changes.

SQL Injection happens when you allow the user direct access to you sql command, and can be exploited to steal, damage or destroy your database. Do not concatenate strings to build a SQL command - use Parametrized queries instead;
cmd = new SqlCommand("INSERT INTO login (userName, password) VALUES (@UN, @PW)", con);
cmd.Parameters.AddWithValue("@UN", TextBox1.Text);
cmd.Parameters.AddWithValue("@PW", TextBox2.Text);

There are two others I would like to add in passing, that it is worth your considering - probably later when yoiu have a bit more experience:
1) Do not use the VS default names for controls: You may remember today that TextBox1 has the username, but will you remember next week? Call it tbUserName or similar, and it becomes more obvious.
2) Do not store passwords in clear text! There is a Tip here explaining why not: Password Storage: How to do it.[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900