Adding Listview Row Items to the database C#

Question

This code is working if my listview has only 1 row. But if the listview has two or more rows, it double~triple etc.

foreach(ListViewItem ItemRow in this.listViewPOS.Items)
{
    for (int i = 0; i < listViewPOS.Count; i++)
    {
        SQLConn.sqL = "INSERT INTO OrderDetails(ProductID, OrderID, SRP, Quantity, Discount, Total) VALUES('" + ItemRow.SubItems[0].Text + "'," +
                "'" + OrderID + "', '" + ItemRow.SubItems[3].Text + "', '" + ItemRow.SubItems[4].Text + "', '" + ItemRow.SubItems[5].Text + "', '" + ItemRow.SubItems[6].Text + "')";

        SQLConn.ConnDB();
        SQLConn.cmd = new SqlCommand(SQLConn.sqL, SQLConn.conn);
        SQLConn.cmd.ExecuteNonQuery();
    }
}

SQL Injection alert - you should not concatenate together your SQL statements - use parametrized queries instead to avoid SQL injection - check out Little Bobby Tables — marc_s
– marc_s, Commented May 24, 2018 at 4:20

Sreenath Ganga · Accepted Answer · 2018-05-24 04:28:27Z

2

It seems that you are looping the item list two times one using foreach and the second using for loop use either one

eg

foreach(ListViewItem ItemRow in this.listViewPOS.Items)
{
            SQLConn.sqL = "INSERT INTO OrderDetails(ProductID, OrderID, SRP, Quantity, Discount, Total) VALUES('" + ItemRow.SubItems[0].Text + "'," +
                "'" + OrderID + "', '" + ItemRow.SubItems[3].Text + "', '" + ItemRow.SubItems[4].Text + "', '" + ItemRow.SubItems[5].Text + "', '" + ItemRow.SubItems[6].Text + "')";

        SQLConn.ConnDB();
        SQLConn.cmd = new SqlCommand(SQLConn.sqL, SQLConn.conn);
        SQLConn.cmd.ExecuteNonQuery();
   }

answered May 24, 2018 at 4:28

Sreenath Ganga

7364 gold badges21 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Reza Aghaei Over a year ago

Use a parametric query to prevent a SQL Injection attack.

Sreenath Ganga Over a year ago

@RezaAghaei .. great advice..I skipped it as Little Bobby Tables – marc_s already advised it in command. and I don't want the beginner to get confused trying something new in mid of this issue

Collectives™ on Stack Overflow

Adding Listview Row Items to the database C#

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related