Syntax error in INSERT into statement vb c#

Question

I am a newbie and currently having problems with this part of my code where i get a syntax error after clicking the button to be recorded in the database.

 private void button1_Click(object sender, EventArgs e)
    {
         FlightConn.Open();
        oleDbCmd.Connection = FlightConn;

        oleDbCmd.CommandText = "insert into tbl_flight (fld_PassengerName, fld_destination, fld_class, fld_date, fld_time) ('" +
        this.textBox1.Text + "', '" + this.textBox2.Text + "', '" + this.comboBox1.SelectedItem + "', '" + this.comboBox2.SelectedItem + "','" + this.dateTimePicker1.Value + "');";
        int temp = oleDbCmd.ExecuteNonQuery();

        if (temp > 0)
        {
            textBox1.Text = null;
            textBox2.Text = null;
            comboBox1.Text = null;
            comboBox2.Text = null;
            dateTimePicker1.Text = null; 


            MessageBox.Show("Record Successfully Added");
        }
        else
        {
            MessageBox.Show("Record Failed to Add");
        }
       FlightConn.Close();
    }

any ideas what the problem is? thank you for any future answers

is it c# or vb.net? why have you tagged both? where does the syntax error occur? have you stepped through your code to see what the values are at each point? — user1666620
– user1666620, Commented Mar 29, 2016 at 11:40
Aren't you missing the VALUES keyword in that INSERT statement? — Joey
– Joey, Commented Mar 29, 2016 at 11:41
You should also add SQL parameters to avoid SQL injection. Also, do you validate any of the input values before saving them. — Peter Smith
– Peter Smith, Commented Mar 29, 2016 at 11:45
Aside from anything else, this code is vulnerable to SQL Injection Attacks. Use parameterized SQL - see msdn.microsoft.com/en-us/library/… for an example. — Jon Skeet
– Jon Skeet, Commented Mar 29, 2016 at 11:45

Tushar Gupta · Accepted Answer · 2016-03-29 11:43:44Z

1

You insert query is missing the Values keyword. Insert into tablename(field1,field2) values(value1,value2)

edited Mar 29, 2016 at 11:43

Tushar Gupta

16k1 gold badge33 silver badges53 bronze badges

answered Mar 29, 2016 at 11:42

Mainak

4683 gold badges10 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ortund · Accepted Answer · 2016-03-29 11:49:19Z

Your SQL command is missing a clause. You should also use parameterized queries rather than inputting the values in plain text into your query. It makes the query more secure since you won't have to worry so much about SQL injection.

Change this:

oleDbCmd.CommandText = "insert into tbl_flight (fld_PassengerName, fld_destination, fld_class, fld_date, fld_time) ('" +
    this.textBox1.Text + "', '" + this.textBox2.Text + "', '" + this.comboBox1.SelectedItem + "', '" + this.comboBox2.SelectedItem + "','" + this.dateTimePicker1.Value + "');";

To something more like this:

oleDbCmd.CommandText = "insert into tbl_flight(fld_PassengerName, fld_destination, fld_class, fld_date, fld_time) values(@PassengerName, @Destination, @Class, @Date, @Time)";

List<OleDbParameter> args = new List<OleDbParameter>();
args.Add(new OleDbParameter("@PassengerName", textBox1.Text));
args.Add(new OleDbParameter("@Destination", textBox2.Text));
args.Add(new OleDbParameter("@Class", comboBox1.SelectedItem));
args.Add(new OleDbParameter("@Date", comboBox2.SelectedItem));
args.Add(new OleDbParameter("@Time", dateTimePicker1.Value));

oleDbCmd.Parameters.Add(args.ToArray());

Eminem · Accepted Answer · 2016-03-29 11:43:54Z

0

You appear to be missing the "VALUES" keyword in your sql statement

answered Mar 29, 2016 at 11:43

Eminem

7,51615 gold badges57 silver badges97 bronze badges

Comments

Hasan BINBOGA · Accepted Answer · 2016-03-29 11:46:10Z

0

Your sql string must be;

string.Format(@"INSERT INTO tbl_flight (fld_PassengerName, fld_destination, fld_class, fld_date, fld_time) 
                                        VALUES ('{0}', '{1}', '{2}', '{3}', '{4}', '{5}');",
                              this.textBox1.Text, this.textBox2.Text, this.comboBox1.SelectedItem,
                              this.comboBox2.SelectedItem, this.dateTimePicker1.Value);

answered Mar 29, 2016 at 11:46

Hasan BINBOGA

83210 silver badges21 bronze badges

Comments

Ortund · Accepted Answer · 2016-03-29 11:50:07Z

0

You missed to specify "values" keyword.. try this

oleDbCmd.CommandText = "insert into tbl_flight (fld_PassengerName, fld_destination, fld_class, fld_date, fld_time) values('" +
    this.textBox1.Text + "', '" + this.textBox2.Text + "', '" + this.comboBox1.SelectedItem + "', '" + this.comboBox2.SelectedItem + "','" + this.dateTimePicker1.Value + "');";

edited Mar 29, 2016 at 11:50

Ortund

8,29619 gold badges80 silver badges151 bronze badges

answered Mar 29, 2016 at 11:42

Manoj

8831 gold badge8 silver badges12 bronze badges

2 Comments

Tushar Gupta Over a year ago

No thanks in the answers please and the keyword is "VALUES" ;)

Jon Skeet Over a year ago

I'd also suggest that any answer which propagates a SQL Injection vulnerability is not helping nearly as much as it could.

Collectives™ on Stack Overflow

Syntax error in INSERT into statement vb c#

5 Answers 5

Comments

Comments

Comments

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

Comments

Comments

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related