Question

I have a website I’m developing, and when a user creates an account I want to store some additional info i have collected during the CreateUserWizard. When I run the code, i get an error when trying to write the data to a table I have created. I created the table in the ASPNETDB.mdf database (the one created by default) called UserProfile and has all the columns I’m trying to write to. In the web.config file I have:

<connectionStrings>
  <add name="ApplicationServices" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|\aspnetdb.mdf;User Instance=true"
  providerName="System.Data.SqlClient" />
</connectionStrings>

When the user creates an account, here is the code I have in the Creating_User event.

protected void RegisterUser_CreatingUser(object sender, LoginCancelEventArgs e)
    {
        //try
        //{
            string trimUserName = RegisterUser.UserName.Trim();
            if (RegisterUser.UserName.Length != trimUserName.Length)
            {
                accountlbl.Text = "The username cannot contain leading or trailing spaces.";
                accountlbl.Visible = true;
                //Cancel the created user info
                e.Cancel = true;
            }

            if (RegisterUser.Password.IndexOf(RegisterUser.UserName, StringComparison.OrdinalIgnoreCase) > 0)
            {
                accountlbl.Text = "The username may not appear anywhere in the password.";
                accountlbl.Visible = true;
                //Cancel the created user info
                e.Cancel = true;
            }


            String FirstName = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("FirstName")).Text;
            String LastName = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("LastName")).Text;
            String Company = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("CompanyName")).Text;
            String PartsList = ((DropDownList)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("companyddl")).SelectedValue;
            String UserName = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("UserName")).Text;
            String Password = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("Password")).Text;
            String Email = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("Email")).Text;
            String Question = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("Question")).Text;
            String Answer = ((TextBox)RegisterUser.CreateUserStep.ContentTemplateContainer.FindControl("Answer")).Text;
            // Insert a new record into User_Profile            
            if ((Company == "OurCompany" || Company == "OurCompany, Inc.") && PartsList == "")
            {
                Roles.AddUserToRole(UserName, "manager");
                UserRole = "manager";
            }
            if (PartsList == "SF")
            {
                Roles.AddUserToRole(UserName, "user_sf");
                UserRole = "user_sf";
            }
            if (PartsList == "TL")
            {
                Roles.AddUserToRole(UserName, "user_tl");
                UserRole = "user_tl";
            }
            if ((Company != "OurCompany" || Company != "OurCompany, Inc.") && PartsList == "")
            {
                Roles.AddUserToRole(UserName, "user");
                UserRole = "user";
            }

            // Get your Connection String from the web.config. ApplicationServices is the name I have in my web.config
            string connectionString = ConfigurationManager.ConnectionStrings["ApplicationServices"].ConnectionString;
            string insertSql = "INSERT INTO UserProfile(FirstName, LastName, Company, PartsList, UserName, Password, Email, Question, Answer, UserRole)" +
                               "VALUES(@FirstName, @LastName, @Company, @Partslist, @UserName, @Password, @Email, @Question, @Answer, @UserRole)";
            using (SqlConnection myConnection = new SqlConnection(connectionString))
            {
                myConnection.Open();
                SqlCommand myCommand = new SqlCommand(insertSql, myConnection);
                myCommand.Parameters.AddWithValue("@FirstName", FirstName);
                myCommand.Parameters.AddWithValue("@LastName", LastName);
                myCommand.Parameters.AddWithValue("@Company", Company);
                myCommand.Parameters.AddWithValue("@PartsList", PartsList);
                myCommand.Parameters.AddWithValue("@UserName", UserName);
                myCommand.Parameters.AddWithValue("@Password", Password);
                myCommand.Parameters.AddWithValue("@Email", Email);
                myCommand.Parameters.AddWithValue("@Question", Question);
                myCommand.Parameters.AddWithValue("@Answer", Answer);
                myCommand.Parameters.AddWithValue("@Role", UserRole);
                myCommand.ExecuteNonQuery();  //ERROR HERE!!!//
                myConnection.Close();                    
            }
    }

I get an error on the myComman.ExecuteNonQuery(); statement saying — Must declare the scalar variable “@UserRole”.
If I comment out the code, it will not write anything to the database table. What am I doing wrong?

Answer 1

You have myCommand.Parameters.AddWithValue("@Role", UserRole);, but I think you should have myCommand.Parameters.AddWithValue("@UserRole", UserRole);.