Passing in SQL query parameter from text boxes

Question

I have the following code in my C# Winforms Application. I am using SQL Lite but how do I pass the values from my text boxes into the insert statement:

void InsertConnectionDetails()
{
    m_dbConnection.Open();

    string sql = "insert into rdpdirectory (company, server, username, password) values (txtCompany, txtServer, txtUsername,txtPassword)";
    SQLiteCommand command = new SQLiteCommand(sql, m_dbConnection);
    command.ExecuteNonQuery();

    m_dbConnection.Close();
    MessageBox.Show("Done");
}

The answer from Sudhakar is the solution, however, old style preferably to be avoided is concatenation, Values ('"+ TextBox1.Text + "' , '" + TextBox2.Text + etc... — FeliceM
– FeliceM, Commented Feb 15, 2014 at 17:55
@FeliceM String concatenation in SQL Queries is bad... very bad. — Evan L
– Evan L, Commented Feb 15, 2014 at 17:56
@EvanL I fully agree with you. This is why I said that the solution is the answer given by Sudhakar. — FeliceM
– FeliceM, Commented Feb 15, 2014 at 17:57
Please do not include information about a language used in a question title unless it wouldn't make sense without it. Tags serve this purpose. — Ondrej Janacek
– Ondrej Janacek, Commented Feb 15, 2014 at 18:00

Sudhakar Tillapudi · Accepted Answer · 2014-02-15 18:03:44Z

6

Solution 1: i can tell you that you need to insert the values directly into INSERT INTO Statement but it leads to SQL Injection Attacks and not recommended.

Try This : (I don't Suggest this)

string sql = @"insert into rdpdirectory (company, server, username, password) 
                   values ('"+txtCompany.Text+"', '"+txtServer.Text+"','"+txtUsername.Text+"','"+txtPassword.Text+"')";

Solution 2: So you can Use Parameterised Queries to be in safer side.

Try This: Using Parameterised Queries (I Suggest this)

string sql = @"insert into rdpdirectory (company, server, username, password) 
               values (@company, @server, @username,@password)";

SQLiteCommand command = new SQLiteCommand(sql, m_dbConnection);
command.Parameters.AddWithValue("@company",txtCompany.Text);
command.Parameters.AddWithValue("@server",txtServer.Text);
command.Parameters.AddWithValue("@username",txtUsername.Text);
command.Parameters.AddWithValue("@password",txtPassword.Text);

edited Feb 15, 2014 at 18:03

answered Feb 15, 2014 at 17:53

Sudhakar Tillapudi

26.3k5 gold badges43 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

PriceCheaperton Over a year ago

Can you help with this: stackoverflow.com/questions/21802384/…

Collectives™ on Stack Overflow

Passing in SQL query parameter from text boxes

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related