System.Data.OleDb.OleDbException: Syntax error in INSERT INTO statement

Question

    public void RegisterUser(string passw,string uname ,string fname ,string lname, string email)
{
    string strSql = @"INSERT INTO User (passw,uname,fname,lname,email) values ('" + passw + "','" + uname + "','" + fname + "','" + lname + "','" + email + "')";                                                           
    cn.Open();
    OleDbCommand cmd = new OleDbCommand(strSql,cn);
    int yy= cmd.ExecuteNonQuery();
    cn.Close();
    cn.Dispose();

}

no matter what i do i get the same error does anyone see here something wrong? or there is another creative way to solve this problem thanks

Use parameterized commands, it's more secure msdn.microsoft.com/en-us/library/yy6y35y8(v=vs.80).aspx — Fabio
– Fabio, Commented Apr 19, 2012 at 22:33
Can you set a breakpoint and print the contents of the query string? — Leopold Stotch
– Leopold Stotch, Commented Apr 19, 2012 at 22:34

Deb · Accepted Answer · 2015-08-10 21:07:44Z

6

Your code here can change dynamically depending on the user input. And that is what causing the error.

Let me explain if any of your input fields contain an apostroph [ ' ] the sql breaks and has now an unclosed quote.

Not only that it also exposes your code to SQL-Injection Attacks.

so i suggest you use parameters for passing value as parameters are treated differenty and are safe as well as prevent SQL-Injection.

    public void RegisterUser(string passw,string uname ,string fname ,string lname, string email)
{
    string strSql = @"INSERT INTO User (passw,uname,fname,lname,email) values     (@passw,@uname,@fname,@lname,@email)";                                                           
    cn.Open();
    OleDbCommand cmd = new OleDbCommand(strSql,cn);
    cmd.Parameters.AddWithValue("@passw",passw);
    cmd.Parameters.AddWithValue("@uname",uname);
    cmd.Parameters.AddWithValue("@fname",fname);
    cmd.Parameters.AddWithValue("@lname",lname);
    cmd.Parameters.AddWithValue("@email",email);
    int yy= cmd.ExecuteNonQuery();
    cn.Close();
    cn.Dispose();
}

edited Aug 10, 2015 at 21:07

answered Apr 20, 2012 at 0:07

Deb

99114 silver badges41 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Deb Over a year ago

You are welcome. just to inform you that If it realy helped then you can accept the answer by ticking the (right) symbol on the left side of this answer.

Vadim K. · Accepted Answer · 2012-04-20 01:19:04Z

0

In Oracle, user is a reserved word and INSERT INTO User ... generates ORA-00903: invalid table name.

answered Apr 20, 2012 at 1:19

Vadim K.

2,61122 silver badges30 bronze badges

Collectives™ on Stack Overflow

System.Data.OleDb.OleDbException: Syntax error in INSERT INTO statement

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related