VB.NET - What is wrong with my SQLinsert? Access database

Question

I have a database with a bunch of stuff in it, and right now I'm reading in data, doing some processing on it, and then sticking it in a new database. My code generates this string:

query_string = "INSERT INTO OrgPhrase (EXACT_PHRASE,Org_ID) VALUES (HELLO,123)"

Then it's used this way:

Dim InsertCmd = New System.Data.OleDb.OleDbCommand(query_string, connection)
InsertCmd.ExecuteNonQuery()

The associated database (OLEdb connection) exists and opens fine, with all the tables and columns it's trying to work with already existing. The error message I get is "No value given for one or more required parameters"

Am I missing something? Did I spell something wrong? I don't have a ton of experience with database work, but I've never had this trouble inserting before.

Nitesh · Accepted Answer · 2011-06-27 19:56:40Z

3

I believe the query should be

query_string = "INSERT INTO OrgPhrase (EXACT_PHRASE,Org_ID) VALUES ('HELLO',123)"

Also, it may happen that the table has more than 2 columns that are NOT NUll and the values to them are required.

answered Jun 27, 2011 at 19:56

Nitesh

2,3532 gold badges44 silver badges72 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Gregory A Beamer Over a year ago

Could be query_string = "INSERT INTO OrgPhrase (EXACT_PHRASE,Org_ID) VALUES ('HELLO','123')" as well, depending on whether Org_Id is a string.

cost Over a year ago

And that fixed it (with some new problems now for me to worry about). For the record, they're both strings.

Gregory A Beamer · Accepted Answer · 2011-06-27 20:01:03Z

2

Consider parameterizing the query string. There are a couple of reasons for this. First, you can pass in the values without having to worry about whether or not you need single quotes. Second, you prevent SQL injection.

query_string = "INSERT INTO OrgPhrase (EXACT_PHRASE,Org_ID) VALUES (@ExactPhrase,@OrgId)"

You then create parametes based on the parameter names in the string. Unless, of course, your query string is always the same values, but that sounds a bit too hardcoded to be good.

answered Jun 27, 2011 at 20:01

Gregory A Beamer

17k3 gold badges27 silver badges32 bronze badges

1 Comment

cost Over a year ago

It's not for use in anything that would be open to injection. I'm building a database from old values to do some new number crunching on them.

Collectives™ on Stack Overflow

VB.NET - What is wrong with my SQLinsert? Access database

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related