InsertQuery from C# to MySql

Question

I am a novice in programming and I hope somebody can help me. I want to store data which I received in C# to MySql: The table should be variable according to the data I received.

string myInsertQuery = String.Format("INSERT INTO volumen (date, time, bidvol, bidprice, askprice, askvol, lastprice, volume) VALUES({0}, {1}, {2}, {3}, {4}, {5}, {6}, {7})", now_date_marketlast, now_time_marketlast, bidvol, bidprice, askprice, askvol, ePrice1, e.Volume);

works, but how to define the table variable. If I replace volumen with {0} and , table doesen´t work. Please help me. Thank you in advance.

Your code has a serious security risk known as SQL injection. I suggest you read up on Parameterized Queries (they will not solve every SQL security issue, but are easy and go a long way toward safer code). — Eric J.
– Eric J., Commented Oct 24, 2011 at 19:00

Dirk Dastardly · Accepted Answer · 2011-10-24 19:03:24Z

1

First off, you probably don't want to do what you're attempting because it opens your code to SQL injection attacks. There are ways, using the SqlCommand object, to dynamically create SQL statements that are not open to SQL injection.

That being said, when you replace volumen with {0}, unless you are adding the table name to the beginning of your list of values, then now_date_marketlast would be inserted as your table name. The proper way to write this would be:

string myInsertQuery = String.Format("INSERT INTO {0} (date, time, bidvol, bidprice, askprice, askvol, lastprice, volume) VALUES({1}, {2}, {3}, {4}, {5}, {6}, {7}, {8})", "volumen", now_date_marketlast, now_time_marketlast, bidvol, bidprice, askprice, askvol, ePrice1, e.Volume);

You're still going to have to supply the table name, you're just doing it at a different point in the code. Again, not a good idea due to SQL injection.

If you're looking for some way for MySQL to determine what table you're using according to what data you're passing in, then you're out of luck as database engines don't tend to work this way.

answered Oct 24, 2011 at 19:03

Dirk Dastardly

1,0573 gold badges12 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

DarthVader Over a year ago

you have an error with your statement. you are assigning wrong value to {0}

Davide Piras · Accepted Answer · 2011-10-24 18:58:42Z

0

try this:

var tableName = "volumen";

string myInsertQuery = String.Format("INSERT INTO {8} (date, time, bidvol, bidprice, askprice, askvol, lastprice, volume) VALUES({0}, {1}, {2}, {3}, {4}, {5}, {6}, {7})", now_date_marketlast, now_time_marketlast, bidvol, bidprice, askprice, askvol, ePrice1, e.Volume, tableName);

answered Oct 24, 2011 at 18:58

Davide Piras

44.7k10 gold badges103 silver badges150 bronze badges

1 Comment

Jusva Over a year ago

That works but if string table; if ((Instrument.FullName) == "$EURUSD") table = "eurusd"; var tableName = table; there occur "not assigned local variable table". What can I do?

DarthVader · Accepted Answer · 2011-10-24 18:59:10Z

0

If you want the table name to be assigned. you can do this:

string myInsertQuery = String.Format("INSERT INTO {8} (date, time, bidvol, bidprice, askprice, askvol, lastprice, volume) VALUES({0}, {1}, {2}, {3}, {4}, {5}, {6}, {7})", now_date_marketlast, now_time_marketlast, bidvol, bidprice, askprice, askvol, ePrice1, e.Volume, volumen);

Volumen is your table name

answered Oct 24, 2011 at 18:59

DarthVader

55.6k78 gold badges225 silver badges309 bronze badges

Collectives™ on Stack Overflow

InsertQuery from C# to MySql

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related