Question

I have a DateTime field in my SQL database which I want to write a time to, but how do I do this?

I’m wanting to do it as a timestamp, so when the user clicks an “add” button it adds the data to the other fields, and a timestamp into the DateTime field, but I keep getting the following error

Conversion failed when converting date and/or time from character string.

This is my current code in the CS file

insertSQL = "INSERT INTO Posts (TopicID, PostBody, PostDate, UserID)"
        + "VALUES ('" + topic + "', '" + newPostText + "', '" + DateTime.Now.ToString() + "', '" + User_ID + "')";

Please note I’m wanting to display as much time info as I can. Eg 23/05/2012 10:58:00 a.m.

Answer 1

Your implementation is prone to SQL Injection. To resolve that, AND your DateTime issue, use parameters – http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.parameters.aspx

Something like this:

string commandText = "INSERT INTO Posts (TopicID, PostBody, PostDate, UserID)"
    + "VALUES (@Topic, @NewPostText, @PostDate, @UserID)";

using (SqlConnection connection = new SqlConnection(connectionString))
{
    SqlCommand command = new SqlCommand(commandText, connection);
    command.Parameters.AddWithValue("@Topic", "My Topic");
    command.Parameters.AddWithValue("@NewPostText", "Post text goes here");
    command.Parameters.AddWithValue("@PostDate", dateObject);
    command.Parameters.AddWithValue("@UserID", "UserA");

    try
    {
        connection.Open();
        Int32 rowsAffected = command.ExecuteNonQuery();
    }
    catch (Exception)
    {
        // Handle Errors    
    }
}