How do inject from Asp.net to a SQL database?

Question

I have a hard time figuring out what is wrong about my code. The purpose is to take data from a registering form in ASP to my user data columns in my SQL database.

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["Connection"].ConnectionString);        

try
{
    string cmd = "insert into UserLogin 
    values(@UserName,@Password)";

    SqlConnection cnn = new SqlConnection(cmd);
    SqlCommand cmd2 = new SqlCommand(cmd, cnn);
    cmd2.Parameters.AddWithValue("@UserName", UsernameBox.Text);
    cmd2.Parameters.AddWithValue("@Password", PasswordBox.Text);

    cnn.Open();
    cmd2.ExecuteNonQuery();

what is wrong about my code - What is wrong? Do you get any error? — Jonatan Dragon
– Jonatan Dragon, Commented Apr 10, 2019 at 12:27
I hope you're not storing passwords as plain text in the database? — Izzy
– Izzy, Commented Apr 10, 2019 at 12:36
Storing passwords as plain text is pretty much criminal negligence. Unless this is a school project you need to fix that immediately. Passwords should be salted and hashed. Also, AddWithValue has some pretty interesting nuances you need to careful of. blogs.msmvps.com/jcoehoorn/blog/2014/05/12/… — Sean Lange
– Sean Lange, Commented Apr 10, 2019 at 13:44
Yeah this is just a practice on how to do it, not a database that is used publicly. — user11340179
– user11340179, Commented Apr 11, 2019 at 12:16

Izzy · Accepted Answer · 2019-04-10 12:30:43Z

2

You're using the connection string in the connection variable but the variable you're passing to SqlCommand is cnn which doesn't have a valid connection string associated with it.

I've cleaned up your code and made use of using block to ensure the correct manner of disposing the object. Please see below:

string connectionString = ConfigurationManager.ConnectionStrings["Connection"].ConnectionString;

using (var con = new SqlConnection(connectionString))
{
   string query = "insert into UserLogin values(@UserName, @Password)";
   using (var cmd = new SqlCommand(query, con))
   {
      cmd.Parameters.AddWithValue("@UserName", UsernameBox.Text);
      cmd.Parameters.AddWithValue("@Password", PasswordBox.Text);

      con.Open();
      cmd.ExecuteNonQuery();
    }
}

answered Apr 10, 2019 at 12:30

Izzy

6,8988 gold badges44 silver badges92 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Aswin A · Accepted Answer · 2019-04-10 12:30:59Z

1

You have two SqlConnection variable and assigning wrong one in the SqlCommand. The working code will be:

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["Connection"].ConnectionString);        

try
{
    string cmd = "insert into UserLogin values(@UserName, @Password)";

    SqlCommand cmd2 = new SqlCommand(cmd, connection);
    cmd2.Parameters.AddWithValue("@UserName", UsernameBox.Text);
    cmd2.Parameters.AddWithValue("@Password", PasswordBox.Text);

    cnn.Open();
    cmd2.ExecuteNonQuery();

answered Apr 10, 2019 at 12:30

Aswin A

10410 bronze badges

Collectives™ on Stack Overflow

How do inject from Asp.net to a SQL database?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related