How to insert data into SQL Server

by

You have to set Connection property of Command object and use parametersized query instead of hardcoded SQL to avoid SQL Injection.

 using(SqlConnection openCon=new SqlConnection("your_connection_String"))
    {
      string saveStaff = "INSERT into tbl_staff (staffName,userID,idDepartment) VALUES (@staffName,@userID,@idDepartment)";

      using(SqlCommand querySaveStaff = new SqlCommand(saveStaff))
       {
         querySaveStaff.Connection=openCon;
         querySaveStaff.Parameters.Add("@staffName",SqlDbType.VarChar,30).Value=name;
         .....
         openCon.Open();

         querySaveStaff.ExecuteNonQuery();
       }
     }

More Related Contents:

  1. How can I round a value in SQL
  2. How do I update a value in C# and SQL Server? [closed]
  3. Delete from two tables? [closed]
  4. Execute Insert command and return inserted Id in Sql
  5. Adding multiple parameterized variables to a database in c#
  6. Insert entire DataTable into database at once instead of row by row?
  7. Getting return value from stored procedure in C#
  8. SQL error: Incorrect syntax near the keyword ‘User’
  9. Passing List to SQL Stored Procedure
  10. Query extremely slow in code but fast in SSMS
  11. How to retrieve data from a SQL Server database in C#?
  12. Code to validate SQL Scripts
  13. Any way to SQLBulkCopy “insert or update if exists”?
  14. SQLException : String or binary data would be truncated
  15. Multi threading C# application with SQL Server database calls
  16. What’s the fastest way to bulk insert a lot of data in SQL Server (C# client)
  17. Generate class from database table
  18. ALTER TABLE DROP COLUMN failed because one or more objects access this column
  19. When executing a stored procedure, what is the benefit of using CommandType.StoredProcedure versus using CommandType.Text?
  20. Can I use ADFS 2.0 to authenticate certain users against SQL Server?
  21. ExecuteNonQuery returning -1 when using sql COUNT despite the query string
  22. What is passing parameters to SQL and why do I need it?
  23. The variable name ‘@’ has already been declared. Variable names must be unique within a query batch or stored procedure
  24. Add WHERE clauses to SQL dynamically / programmatically
  25. How to pass a null variable to a SQL Stored Procedure from C#.net code
  26. Use SQL Server time datatype in C#.NET application?
  27. Database Error: There is no row at position 0
  28. How to give ADO.NET Parameters
  29. Capturing count from an SQL query
  30. Is SqlConnection.Close() need inside a Using statement?

Leave a Comment