Click here to Skip to main content
15,891,657 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
I want insert string entry textbox into my database, but error:
C#
SqlConnection conn = new SqlConnection(@"Data Source=.;Initial Catalog=QLSV_LogIn;uid = sa; pwd = 123456");

private void btnCap_nhat_Click(object sender, EventArgs e)
{
    try
    {
        if (txtKhoa.Text == "")
        {
            MessageBox.Show("Empty","Eror 1");
            txtKhoa.Focus();
        }
        else
        {
            conn.Open();
            SqlCommand cmd = new SqlCommand("Insert Into tblKhoa (TenKhoa) Value('" + txtKhoa.Text + "')", conn);

            cmd.ExecuteNonQuery();

            MessageBox.Show("Success");

            conn.Close();

            txtKhoa.Text = "";
            txtKhoa.Focus();
        }
    }
    catch
    {
        MessageBox.Show("Error 2");
    }
}


when i insert, it show Error 2??? Why??? Help me
Posted

Change:
C#
catch
            {
                MessageBox.Show("Error 2");
            }


To
C#
catch (Exception ex)
            {
                MessageBox.Show(ex.tostring());
            }

And tell us what the error is!
 
Share this answer
 
Comments
Nguyễn Quang Nghĩa 20-Jun-13 3:33am    
Message: Error in cmd.ExecuteNonQuery();
Pheonyx 20-Jun-13 3:39am    
Is that all it says? Does it not give you more details such as issues with the syntax? no open connection etc?
Replace "Value" to "Values" in this line..

Change this

SqlCommand cmd = new SqlCommand("Insert Into tblKhoa (TenKhoa) Value('" + txtKhoa.Text + "')", conn);

To


SqlCommand cmd = new SqlCommand("Insert Into tblKhoa (TenKhoa) Values('" + txtKhoa.Text + "')", conn);
 
Share this answer
 
v3
Right a few pointers.

You need to parametrise your try, catch block:

C#
try
{
//Do something
}
catch(Exception ex)
{
//ex contains the error information.
}


Also concatenating the the text value into the command is going to open you up to SQL injection.

If I entered:

GO delete from tblKhoa GO

Into your text box it's possible I could delete all the records from the row.

You should use parameters.

C#
SqlCommand cmd = new SqlCommand("Insert Into tblKhoa (TenKhoa) Value(@MyValue)", conn);
IDbDataParameter param = cmd.CreateParameter();
param.Name = "@MyValue";
param.Type = DbType.String;
param.Value = txtKhoa.Text;
cmd.Parameters.Add(param);


This stop the user including SQL syntax in the text box and cause damage to your database.
 
Share this answer
 
Comments
Stephen Hewison 20-Jun-13 4:37am    
Really? Why the down vote?
Shanalal Kasim 20-Jun-13 5:57am    
+5
Stephen Hewison 20-Jun-13 7:00am    
Thanks
Instead of calling the Insert command, try to do it in SP, and call it by storedProcedure Method.
 
Share this answer
 
catch(Exception ex)
{
throw ex;
}
 
Share this answer
 
Comments
Sergey Alexandrovich Kryukov 2-Jul-13 0:57am    
What an abuse! This is code which does not do anything, only wasted CPU resources. Amazing.
—SA

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900