Add path to SQL Server using c#

Question

I tried adding a file path to SQL Server from a C# application and that this exception that appeared :

An unhandled exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll

Additional information: Incorrect syntax near 'C:\Users\Misfen\Desktop\image.jpg'.

private void button9_Click(object sender, EventArgs e)
{
    OpenFileDialog dlg = new OpenFileDialog();
    dlg.Filter = "JPG FILES (*.jpg)|*.jpg|JPEG FILES (*.jpeg)|*.jpeg|PNG FILES (*.png)|*.png";

    if (dlg.ShowDialog() == DialogResult.OK)
    {
        string picpath = dlg.FileName.ToString();
        listBox2.Items.Add(picpath);

    }
}

private void button5_Click(object sender, EventArgs e)
{
    OpenFileDialog dlg = new OpenFileDialog();
    dlg.Filter = "JPG FILES (*.jpg)|*.jpg|JPEG FILES (*.jpeg)|*.jpeg|PNG FILES (*.png)|*.png|PDF FILES (*.pdf)|*.pdf|DOC FILES (*.doc)|*.doc";

    if (dlg.ShowDialog() == DialogResult.OK)
    {
        string picpath = dlg.FileName.ToString();
        textBox4.Text = picpath;
    }
}

private void button6_Click(object sender, EventArgs e)
{
    OpenFileDialog dlg = new OpenFileDialog();
    dlg.Filter = "JPG FILES (*.jpg)|*.jpg|JPEG FILES (*.jpeg)|*.jpeg|PNG FILES (*.png)|*.png|PDF FILES (*.pdf)|*.pdf|DOC FILES (*.doc)|*.doc";

    if (dlg.ShowDialog() == DialogResult.OK)
    {
        string picpath = dlg.FileName.ToString();
        textBox5.Text = picpath;
    }
}

private void button7_Click(object sender, EventArgs e)
{
    OpenFileDialog dlg = new OpenFileDialog();
    dlg.Filter = "JPG FILES (*.jpg)|*.jpg|JPEG FILES (*.jpeg)|*.jpeg|PNG FILES (*.png)|*.png";

    if (dlg.ShowDialog() == DialogResult.OK)
    {
        string picpath = dlg.FileName.ToString();
        listBox1.Items.Add(picpath);
    }    
}

C# code :

String req = "insert into dommage_materiel values(" + textBox1.Text + ",'" + richTextBox2.Text + "','" + richTextBox1.Text + "','" + textBox3.Text + "','" + dateTimePicker1.Value + "','" + richTextBox3.Text + "','" + textBox2.Text + "','" + textBox4.Text.ToString() + "','" + textBox5.Text.ToString() + "'";

SqlCommand cmd = new SqlCommand(req, cnx);

cnx.Open();
cmd.ExecuteNonQuery();
cnx.Close();

for (int i = 0; i < listBox1.Items.Count; i++)
{
    SqlCommand cmd2 = new SqlCommand("insert into photo_domage values ('"+textBox1.Text+"','"+listBox1.Items[i].ToString()+"')", cnx);

    cnx.Open();
    cmd2.ExecuteNonQuery();
    cnx.Close();
}

for (int i = 0; i < listBox2.Items.Count; i++)
{
    SqlCommand cmd2 = new SqlCommand("insert into fichier_domage values ('" + textBox1.Text + "','" + listBox1.Items[i].ToString() + "')", cnx);

    cnx.Open();
    cmd2.ExecuteNonQuery();
    cnx.Close();
}

SQL code :

create table dommage_materiel
(
     num varchar(30) primary key,
     object_sistre varchar(500),
     discription varchar(1500),
     lieux varchar(100), 
     date_inci date, 
     domage varchar(50), 
     estimation varchar(30), 
     pv nvarchar(150), 
     facture nvarchar(1500)
)

create table photo_domage
(
     num varchar(30) foreign key references dommage_materiel (num), 
     ref nvarchar(1500)
)

create table fichier_domage 
(
     num varchar(30) foreign key references dommage_materiel (num),
     ref nvarchar(1500)
)

Recommended reading - stackoverflow.com/questions/7505808/… — Eugene Podskal
– Eugene Podskal, Commented Mar 7, 2016 at 19:38
SQL Injection alert - you should not concatenate together your SQL statements - use parametrized queries instead to avoid SQL injection — marc_s
– marc_s, Commented Mar 7, 2016 at 19:46

Community · Accepted Answer · 2017-05-23 10:27:58Z

4

You forgot two single quotes around the first value, and there is also a closing bracket missing.

Just replace

insert into dommage_materiel values(" + textBox1.Text + ",

with

insert into dommage_materiel values('" + textBox1.Text + "', .... ");

Anyway, I strongly recommended you to make use of Sql Parameters. Here is a good and short explanation.

edited May 23, 2017 at 10:27

CommunityBot

11 silver badge

answered Mar 7, 2016 at 19:42

Marc

3,9594 gold badges24 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Ayvin Over a year ago

Yes , thank you i didn't notice that but the same problem still apears

Marc Over a year ago

There is also a closing bracket missing at the end.

Marc Over a year ago

Alright, I have updated my answer. You're welcome :-)

Marc Over a year ago

Please close the question by mark it as answered, if that helped you.

Collectives™ on Stack Overflow

Add path to SQL Server using c#

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related