Why does not this SQL server INSERT query execute?

Question

I work on an ASP.NET project (using serenity.is) and have now a problem with a database query :

[HttpGet]
[Route("SimonTest/{id=0}/{obj=0}")]
public ActionResult SimonTest(int id, int obj)
{
    SqlConnection myConn = new SqlConnection(@"Server=(LocalDb)\MSSqlLocalDB;Integrated security=SSPI;database=Serene5_Default_v1");

    // skipped code building the following command :

    command = "INSERT INTO [Serene5_Default_v1].[tcpdump].[Errors] (TimeStp,IdSource,IdDestination,PortSource,PortDestination,ToTheRight,ToTheLeft) VALUES ('11:2','11','1','1','1',1,1);";


    System.Diagnostics.Debug.WriteLine(command);
    SqlCommand myCommand2 = new SqlCommand(listDb, myConn);


    myCommand2.ExecuteNonQuery();

    System.Diagnostics.Debug.WriteLine("Commande exécutée");
    myCommand2.Dispose();


    myConn.Close();
    return View("~/Modules/Default/TcpDump/TcpDumpIndex.cshtml");
}

When I execute the query INSERT INTO ... with Microsoft SQL Server Management Studio, nothing goes wrong, but here the command seems to be skipped (no exception raised and nothing written in database)

And where exactly do you assign the SQL to execute to your command object? What is listDb? Did you mean to use command when constructing the SqlCommand object? — Lasse V. Karlsen
– Lasse V. Karlsen, Commented Aug 16, 2017 at 8:33
command != listDb. No idea what the contents of the latter is, but that's what you're executing. — Damien_The_Unbeliever
– Damien_The_Unbeliever, Commented Aug 16, 2017 at 8:34
Ok damn.. Was right at the beginning, and i wrote a new command and forgot to make every changes x) — Doe Jowns
– Doe Jowns, Commented Aug 16, 2017 at 8:36
I would like to point out that the "skipped code" that builds the SQL seems to insert values into it as well, you should use parameters, not concatenated SQL statements, depending on where you get these values from you might open yourself to sql injection attacks. — Lasse V. Karlsen
– Lasse V. Karlsen, Commented Aug 16, 2017 at 8:38
If you pick the values from textboxes on the screen then I can write this: '; drop database x; select 1, ' this will then be concatenated into your SQL and bye bye database. Most likely won't this particular query execute but with some experimentation I should be able to either retrieve data you don't want me to or modify it. This bug is called SQL Injection - w3schools.com/sql/sql_injection.asp. — Lasse V. Karlsen
– Lasse V. Karlsen, Commented Aug 16, 2017 at 8:43

Konstantin Zadiran · Accepted Answer · 2017-08-16 08:35:38Z

3

You forgot to assign sql text to command myCommand2.CommandText = command before executing query.

answered Aug 16, 2017 at 8:35

Konstantin Zadiran

1,5612 gold badges22 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Lasse V. Karlsen Over a year ago

He does in fact assign a SQL to the command, the constructor, listDb is that SQL, but it is the wrong SQL (most likely).

Konstantin Zadiran Over a year ago

@LasseV.Karlsen maybe assignment of command text to the listDb is missing. And also it throws an exception when sql is wrong

Saneesh kunjunni · Accepted Answer · 2017-08-16 09:27:37Z

0

may be because of connection is not open that why it's not updating

SqlCommand myCommand2 = new SqlCommand(listDb, myConn.Open());

answered Aug 16, 2017 at 9:27

Saneesh kunjunni

5485 silver badges17 bronze badges

1 Comment

Doe Jowns Over a year ago

Good point, I deleted it in the post, but actually opened it in my code ^^

Collectives™ on Stack Overflow

Why does not this SQL server INSERT query execute?

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related