c# - SqlCommand insertion query -
i have execute query of insertion in c# code
connexion = new sqlconnection(connexionstring); connexion.open(); list<int> liste = client.getidfichiers(1210); int = 2; foreach (int idfichier in liste) { a++; using (connexion) { using (sqlcommand sqlcmd = new sqlcommand("insert rel_fab3dlotfichier_fichier3d (idrel_fab3dlotfichier_fichier3d,idfichier3d,idfab3dlotfichier,creepar,creele,modifiepar,datemaj,estactif) values (" + + "," + idfichier + "," + 17965 + "," + null + "," + null + "," + null + "," + null + "," + 1 + ")", connexion)) { try { sqlcmd.executenonquery(); } catch (exception ex) { messagebox.show(ex.tostring()); } } } }
the insertion isn't working , don't know why. selection , delete queries worked fine. when try insert values syntaxic error appears.
- what syntax error?
- how can fix it?
some of values passing may string/varchar objects , aren't wrapping them quotes:
new sqlcommand("insert rel_fab3dlotfichier_fichier3d (idrel_fab3dlotfichier_fichier3d,idfichier3d) values ('" + + "', '" + idfichier + "')", connexion);
really, avd suggested, should use parameterisation, less prone injection attacks.
Comments
Post a Comment