Question

I have this program that is feeding me data. I take this data (string) and parse it so that the different fields can go into the respective db table column. I can parse the string but I can’t find the right function or way to send them to the db. This is my second time working with sql server or database in general. I have done inserts this way

MyCommand.CommandType = System.Data.CommandType.Text;
MyCommand.CommandText = "INSERT INTO TimeStampTable(ID, TimeStamp) VALUES ('24', 'sep 13, 2009')";

From what I know, CommandType only allows either text or a stored procedure. In this case, I would want to insert the string that is being parsed.

string teststring = dtString;
string[] result = teststring.Split(',', ' ', ':', '=');
Console.WriteLine("The parsed string looks like this:");
foreach (string word in result)
{
    Console.WriteLine(word);
}

This is my code that parses my incoming string. So I receive name address zip state, etc. I would like for name to go to col1, address to go to col2, etc. I think the ideal way to do this would be to convert my loop to something like this

foreach (string word in result)
{
    SqlDatasource.InsertCommand=Insert into Tablename col1 col2 col3(word);
}

Does anyone have any suggestions?

Answer 1

I will answer your question directly, but there are many different ways that you could go about performing the same thing (I will list some at the end)

String insertQuery = "INSERT INTO TABLENAME (Col1, Col2, Col3...) VALUES (";
//This is also assuming that your data is in the same order as the columns
int isFirstLoop = true
foreach(string word in result)
{
    if(!isFirstLoop)
        insertQuery += ","
    insertQuery += word;
    isFirstLoop = false;        
}
insertQuery += ")";
SqlDataSource.InsertCommand = insertQuery;

NOTE: this is very open to SQL Injection, so keep that in mind (do you trust your incoming source). There are ways to clean the data, but ultimately, I suggest some of the methods listed below

Alternatives:

• Use a stored procedure over direct TSQL. Then you can map your data to SQLParameters, which (I believe) are built to scrub the data to protect against SQL Injection
• Use a very basic ORM and/or LINQ so that you can work with objects directly. Then you only need to read the data into a POCO
• I am sure there are other ways, however for some reason I am drawing a blank. I think that is because these are the most used alternatives 🙂