Syntax error in INSERT INTO statement in c# OleDb Exception cant spot the error

Question

EXACT duplicate of Syntax error in INSERT INTO statement in c# oledb?

Hi I cant spot the error. Please help. There is an OleDb Exception due to a Syntax Error. Syntax error in INSERT INTO statement OleDb Exception is unhandled.

    private OleDbConnection myCon;

    public Form1()
    {
        InitializeComponent();
        myCon = new OleDbConnection(@"Provider=Microsoft.Jet.OLEDB.4.0; Data Source=C.mdb");
    }

private void insertuser_Click(object sender, EventArgs e)
    {
        try
        {
            OleDbCommand cmd = new OleDbCommand();
            myCon.Open();
            cmd.Connection = myCon;
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "INSERT INTO User ([UserID], [Forename], [Surname], [DateOfBirth], [TargetWeight], [TargetCalories], [Height]) Values ('" + userid.Text + "' , '" + fname.Text + "' , '" + sname.Text + "' , '" + dob.Text + "' , '" + tarweight.Text + "' , '" + tarcal.Text + "' , '" + height.Text + "')";


            cmd.ExecuteNonQuery();
            myCon.Close();
        }
        catch (Exception ex) { MessageBox.Show(ex.ToString()); }



    }

Are you kidding us? Would you care to tell us what the error is? — Randy Minder
– Randy Minder, Commented Jan 7, 2011 at 16:53
Put brackets [] around the table name "User". It's a reserved word in SQL Server. — Tim M.
– Tim M., Commented Jan 7, 2011 at 16:54
EXACT duplicate of Syntax error in INSERT INTO statement in c# oledb? — marc_s
– marc_s, Commented Jan 7, 2011 at 16:54
You've just ask this very question a few minutes ago - don't keep asking the same question over and over again! — marc_s
– marc_s, Commented Jan 7, 2011 at 16:55

Brett · Accepted Answer · 2011-01-07 16:56:39Z

1

What are the values you're attempting to insert? Is height perhaps in feet and inches (5'10")? In which case you'll have closed the string (') and will have a syntax error.

And I agree wholeheartedly with @Brennan Vincent. Constructing raw SQL is not the way forward.

answered Jan 7, 2011 at 16:56

Brett

1,67010 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Brennan Vincent · Accepted Answer · 2011-01-07 16:56:00Z

0

If TargetWeight, Height, and TargetCalories are floating-point or integer values, they don't need to be surrounded by quotes in the SQL statement.

Also, not directly related to your question, but you should really consider using a parameterized query. Your code is very vulnerable to SQL injection.

answered Jan 7, 2011 at 16:56

Brennan Vincent

10.8k9 gold badges37 silver badges59 bronze badges

Collectives™ on Stack Overflow

Syntax error in INSERT INTO statement in c# OleDb Exception cant spot the error

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related