error in c# :One Or More Error Messages Occurred During Processing Of Command

Question

this is my code:

OleDbConnection con = new OleDbConnection();
con.ConnectionString = "Provider=MSDAORA;Data Source=data;Password=ss8_pakhsh;User ID=SHIFTS_N";
            con.Open();
int MAXID = 1175;
 MAXID++;
string sqlcommand = "INSERT INTO GROUPS(GROUP_ID, GROUP_NAME,DEPT_ID) " +
                              "VALUES(" + MAXID + ",'"
                              + textBox1.Text +
                             "', SELECT DEPT_ID FROM PERSONNEL_TEMP.DEPARTMENT WHERE DEPARTMENT_NAME="+comboBox1.Text;
 OleDbDataAdapter oda = new OleDbDataAdapter(sqlcommand, con);
            oda.Fill(dt);
            con.Close();

while i running it ,gets this error :

One or more errors occurred during processing of command.

i think my query has problem because when i enter it on TOAD editor(for oracle) gets me this error:

ORA-00936: missing expression

SQL Injection alert - you should not concatenate together your SQL statements - use parametrized queries instead to avoid SQL injection — marc_s
– marc_s, Commented Jun 24, 2015 at 4:52
Incorrect quotes may lead you error..check the quotes string .and most important SQL injection! — Tharif
– Tharif, Commented Jun 24, 2015 at 4:53

Nagaraj S · Accepted Answer · 2015-06-24 06:01:30Z

2

You were missing quotes and paranthesis in your query.

SQL Injection Alert

To avoid this you should use Parameterized queries as like follows

string sqlcommand ="INSERT INTO GROUPS(GROUP_ID, GROUP_NAME,DEPT_ID)  
                           VALUES(?,?,SELECT DEPT_ID FROM PERSONNEL_TEMP.DEPARTMENT WHERE DEPARTMENT_NAME=?)";
OleDbConnection oledbConnection = new OleDbConnection(con);
OleDbCommand oledbCommand = new OleDbCommand(sqlcommand , oledbConnection);
oledbCommand.Parameters.AddWithValue("?", txtquotationno.Text);
oledbCommand.Parameters.AddWithValue("?", cmbjobcode.Text);
oledbCommand.Parameters.AddWithValue("?", comboBox1.Text);
OleDbDataAdapter oda  = new OleDbDataAdapter(oledbCommand);
DataTable dt= new DataTable();
oda.Fill(dt);

edited Jun 24, 2015 at 6:01

answered Jun 24, 2015 at 5:00

Nagaraj S

13.5k6 gold badges35 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Fatemeh Hojjati Over a year ago

I DO IT BUT STILL GETS ME ERROR

Fatemeh Hojjati Over a year ago

THE ERROR Occurred ON oda.Fill(dt);

Mairaj Ahmad · Accepted Answer · 2015-06-24 04:59:04Z

0

You need to put your select query in braces as you are selecting this from another table so this shoould be in (). Also Department_Name looks of type varcharso its value should be in single quotes. Change your query like this.

string sqlcommand = "INSERT INTO GROUPS(GROUP_ID, GROUP_NAME,DEPT_ID) " +
                              "VALUES(" + MAXID + ",'"
                              + textBox1.Text +
                             "',(SELECT DEPT_ID FROM PERSONNEL_TEMP.DEPARTMENT WHERE DEPARTMENT_NAME='"+comboBox1.Text+"'"));

Also use parameterized query to prevent sql injection.

answered Jun 24, 2015 at 4:59

Mairaj Ahmad

14.6k2 gold badges29 silver badges43 bronze badges

Collectives™ on Stack Overflow

error in c# :One Or More Error Messages Occurred During Processing Of Command

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related