Question

I am storing data (approx. 1500 words) in SQL server 2005 through textbox and button. I am using this code.

protected void Button1_Click(object sender, EventArgs e)
{
    conn.Open();
    String query = String.Format("insert into try (data,sno) values ('{0}',22)",TextBox1.Text);
    SqlCommand cmd = new SqlCommand(query, conn);
    cmd.ExecuteNonQuery();
    Label1.Text = "submitted";
    conn.Close();
}

I have column 'data' of data type 'char(4000)'.

Problem is that, when I store 1st paragraph (approx 1500 words), it stored successfully. But when I stored another paragraph (approx 1500 words), it show me the error.

“Incorrect syntax near ‘s’. Unclosed quotation mark after the
character string ‘,22)’.”

What is the problem ??

Answer 1

Use Parameters

String query = "insert into try (data,sno) values (@data,22)"; 
SqlCommand cmd = new SqlCommand(query, conn); 
cmd.Parameters.AddWithValue("@data", TextBox1.text);
cmd.ExecuteNonQuery(); 

In this way you don’t need to worry about the presence of single quotes in your text and, the most important thing, you avoid SqlInjection Attacks