Create SQL Server database from C# - using parameters

Question

I am trying to put up a code to create a databases from my C# code (asp.net website).

This is my code:

SqlCommand myCommand = new SqlCommand("CREATE DATABASE @dbname", nn);
myCommand.Parameters.Add("dbname", dbname);

myCommand.ExecuteNonQuery();
nn.Close();

well, its not working. its giving me an error:

incorrect syntax near '@dbname'

BUT. if I won't use parameters, people can SQL inj to my database. do you have any idea how can use anything, to get the database name from a textbox. and that people can't SQL inj me database?

podiluska · Accepted Answer · 2012-10-01 09:36:35Z

4

You can't use parameters in CREATE DATABASE or other DDL commands.

I'd suggest using SQL Server Management Objects instead of SQL

answered Oct 1, 2012 at 9:36

podiluska

51.6k7 gold badges102 silver badges105 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Alon M Over a year ago

I see that link, but i can't understand anything, do you have a code sample?

Ben Thul Over a year ago

Not to be snarky, but the posted link has the simplest possible sample code. Work at understanding it.

Collectives™ on Stack Overflow

Create SQL Server database from C# - using parameters

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related