sql syntax the insert command using in razor webmatrix

Question

is there any probleme with this sql syntax

  @{
var userId = Request["UserId"];
     var db = Database.Open("intranet");
    var query3 = "INSERT INTO CongeAccept(UserId,DateDebut,DateFin,TypeConge) SELECT UserId,DateDebutDemande,DateFinDemande,TypeConge FROM DemandeConge WHERE UserId = '" + userId + "'";
            db.Execute(query3); }

Conrad Frix · Accepted Answer · 2012-02-28 00:00:16Z

1

is there any probleme with this sql syntax

It largely depends on where the userID is coming from. If its user supplied you're opening yourself up to a SQL injection attack

You should use parameters instead. As added bonus you don't have to worry about putting quotes around the values.

 var query3 = @"INSERT INTO CongeAccept(UserId,DateDebut,DateFin,TypeConge) 
               SELECT UserId,DateDebutDemande,DateFinDemande,TypeConge 
               FROM DemandeConge 
               WHERE UserId = @0";
 db.Execute(query3, userId );

edited Feb 28, 2012 at 0:00

answered Feb 27, 2012 at 23:38

Conrad Frix

52.8k13 gold badges100 silver badges158 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

user1233875 Over a year ago

tnks fr the notice dudde ^^ so when i want to use a variable name i put "@" before the var name ?

Conrad Frix Over a year ago

Yeah but the variable name doesn't actually matter since it replaces by the order it appears. See the Database.Execute Method

user1233875 Over a year ago

unfortunately :s :s it shows me this msg : A parameter is missing. imageup.fr/uploads/1330386509.png

Conrad Frix Over a year ago

it should be db.Execute(query3, UserId ) not db.Execute(query3)

user1233875 Over a year ago

i already use it but it doesn't work they show me this msg : imageup.fr/uploads/1330386739.png

|

Collectives™ on Stack Overflow

sql syntax the insert command using in razor webmatrix

1 Answer 1

9 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

9 Comments

Your Answer

Sign up or log in

Post as a guest

Related