Adding textbox values to an SQL database in c# -
i'm trying add values textbox datagridview, have asked question before i'm getting different error saying
there more columns in insert statement values specified in values clause. number of values in values clause must match number of columns specified in insert statement.
this code causing error
private void savebtn_click(object sender, eventargs e) { sqlconnection sc = new sqlconnection(); sqlcommand com = new sqlcommand(); sc.connectionstring = ("data source=localhost;initial catalog=loginscreen;integrated security=true"); sc.open(); com.connection = sc; com.commandtext = ("insert stock (prod_id, prod_name, prod_cat, supplier, cost, price_1, price_2, price_3) values ('"+prodid.text+"''"+prodname.text+"'+'"+prodcat.text+"'+'"+prodsup.text+"'+'"+prodcost.text+"'+'"+prodprice1.text+"'+'"+prodprice2.text+"'+'"+prodprice3.text+"');"); com.executenonquery(); sc.close(); }
you missing commas in values part of sql. when ever doing (big concatination of string) should know 2 things. first, way test write out console, messagebox, ext. see error right away. next thing know if concatintating insert db, dont it. use parameterized queries. -> how parameterized queries against sql injection?
com.commandtext = ("insert stock (prod_id, prod_name, prod_cat, supplier, cost, price_1, price_2, price_3) values ('"+prodid.text+"''"+prodname.text+"'+'"+prodcat.text+"'+'"+prodsup.text+"'+'"+prodcost.text+"'+'"+prodprice1.text+"'+'"+prodprice2.text+"'+'"+prodprice3.text+"');");
should this
com.commandtext = (@"insert stock (prod_id, prod_name, prod_cat, supplier, cost, price_1, price_2, price_3) values ('"+prodid.text+"','"+prodname.text+"','"+prodcat.text+"','"+prodsup.text+"','"+prodcost.text+"','"+prodprice1.text+"','"+prodprice2.text+"','"+prodprice3.text+"');"));