Question

I am wondering why I get an exception on the SqlDataReader reader2 = theCommandInsert.ExecuteReader();

This is the code I use :

var conString = ConfigurationManager.ConnectionStrings["LocalSqlServer"];
string strConnString = conString.ConnectionString;

SqlConnection dbConnection = new SqlConnection(strConnString);

dynamic queryString = ("INSERT INTO FOLDERS (Name) VALUES ('" + txtBoxFolderLabel.Text + "' ) ");

int param = CheckBoxList2.SelectedIndex;
param = param + 1;

dynamic queryStringInsert = ("INSERT INTO GROUPS_FOLDERS (Folder_Id, Group_Id) VALUES(IDENT_CURRENT('Folders') , " + param + " )");
SqlCommand theCommand = new SqlCommand(queryString, dbConnection);
SqlCommand theCommandInsert = new SqlCommand(queryStringInsert, dbConnection);

//Connection opening and executing
if (string.IsNullOrEmpty(txtBoxFolderLabel.Text) | CheckBoxList2.SelectedIndex.ToString() == null)
{
   Response.Write("Empty fields !");
}
else if (Functions.IsNumeric(txtBoxFolderLabel.Text))
{
   Response.Write("No numerics !");
}
else
{
   dbConnection.Open();
   SqlDataReader reader = theCommand.ExecuteReader();

   string folderName = txtBoxFolderLabel.Text;

   // Create folder 
   System.IO.Directory.CreateDirectory("C://inetpub//wwwroot//Files//" + folderName);

   dbConnection.Close();

   dbConnection.Open();
   SqlDataReader reader2 = theCommandInsert.ExecuteReader();
   dbConnection.Close();

This is the exception I get:

The INSERT statement conflicted with the FOREIGN KEY constraint “FK_GROUPS_FOLDERS_Groups”. The conflict occurred in database
“9B15719DF48C3E2301D7F965674A6F93_VISUAL STUDIO
2010\PROJECTS\CLIENTPORTAL\APPLICATIONUI\WEBSITE\CLIENTPORTAL\APP_DATA\DATAUI.MDF”,
table “dbo.Groups”, column ‘Id’.

I did check in the database, there is no Id duplicated or something ..

Could you help me please ?

Cheers.

Answer 1

Why are you using dynamic for your query string? It’s a string, define it as such.

You are also setting yourself up to allow someone to perform a SQL Injection attack on your site.

string queryString = ("INSERT INTO FOLDERS (Name) VALUES ('" + txtBoxFolderLabel.Text + "' ) ");

Is not a good idea, you should be using Sql Parameters.

string queryString = ("INSERT INTO FOLDERS (Name) VALUES (@folder) ");

You can define your parameter after you create your command

theCommand.Parameters.AddWithValue("@folder", txtBoxFolderLabel.Text);

As for your specific error it looks like you have a foreign key defined on that table and you are not meeting the requirements of the foreign key