Click here to Skip to main content
15,886,769 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
C#
str = "INSERT INTO studtable(enquiry_no,date,stud_name,col_name,address,qualification,mobile,course,duration,sreq,payment,overall,sign) VALUES('"+lcount.Text+"','" + dt.Text + "','" + tstud.Text + "','" + tcolg.Text + "','" + taddr.Text + "','" + tqua.Text + "','tmob','" + str1 + "','" + str1 + "','" + str1 + "','tfee','" + tedit.Text + "','"+tsign.Text+"')";

                scd.Connection = cn;
                scd.CommandText = str;
Posted
Updated 12-Aug-15 22:20pm
v2

Use parameters instead of concatenating strings for sql statement. your application is pen for sql injection attacks.
read : SqlCommand.Parameters[^]
Inserting radio button data is depends on which data type you have in your table. if it is bit datatype you can insert as boolean value of yourcheckBox.Checked property
for example using parameters:
C#
cmd.Parameters.AddWithValue("@colname", yourcheckBox.Checked);
 
Share this answer
 
v2
Comments
Maciej Los 13-Aug-15 4:31am    
5ed!
DamithSL 13-Aug-15 4:42am    
Thank you, Maciej
Afzaal Ahmad Zeeshan 13-Aug-15 4:46am    
5ed
DamithSL 13-Aug-15 4:46am    
Thank you, Afzaal
First of all, your code is SQL Injection[^] vulnerable!

How To: Protect From SQL Injection in ASP.NET[^]
Do Stored Procedures Protect Against SQL Injection?[^]
SQL Injection and how to avoid it[^]

Instead of such of command, use parametrized query:
SQL
INSERT INTO TableName (<Set_of_Fields>: Field1, Field2, Field3, etc.) VALUES(<Set_Of_Parameters>: @param1, @param2, @param3, etc.)


See: SqlParameterCollection.AddWithValue Method[^]
 
Share this answer
 
Comments
DamithSL 13-Aug-15 4:38am    
5wd!
Maciej Los 13-Aug-15 4:41am    
Thanks!
First of all no need to use the code open for SQL Injection instead use parametrize query.

A Simple Example:

if u have 2 radio buttons in your code whose datatype is char(1) in the database table 'Persons' (if its bool then change the code accordingly while passing the parameters)
ASP.NET
<asp:radiobutton id="rbMale" text="Male" runat="server" groupname="Gender"/>
<asp:radiobutton id="rbFemale" text="Female" runat="server" groupname="Gender"/>


Use the following code for saving its value into the database table.

C#
string gender = string.Empty;
   if (rbMale.Checked)
   {
       gender = "M";
   }
   else if (rbFemale.Checked)
   {
       gender = "F";
   }
   string constr = ConfigurationManager.ConnectionStrings["constr"].ConnectionString;
   using (SqlConnection con = new SqlConnection(constr))
   {
       using (SqlCommand cmd = new SqlCommand("INSERT INTO Persons(Gender)VALUES(@Gender)"))
       {
           cmd.Connection = con;
           cmd.Parameters.AddWithValue("@Gender", gender);
           con.Open();
           cmd.ExecuteNonQuery();
           con.Close();
       }
   }


Add the parameters according to your form values.

Hope It Helps :)
 
Share this answer
 
v3

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900