Question

I keep getting the same vague error with this code:

command.CommandText = "INSERT INTO database (upc, title, description, quantity) VALUES ('"+ upc.Text +"',"+"'"+titlename+"',"+ "'"+descname+"',"+ "'1'"+"), MyConString";

The error is:

{“You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near ‘database (upc, title, description, quantity) VALUES
(‘016000165779′,’Betty Crock’ at line 1”}

I’m new at C# and trying to build a program that uses UPC codes that get inserted into a mySQL database.

Answer 1

Try this:

command.CommandText = "INSERT INTO tableName " +
                          "(upc, title, description, quantity) " +
                      "VALUES " +
                          "(@upc, @title, @description, @quantity)";

command.Parameters.AddWithValue("@upc", upc.Text);
command.Parameters.AddWithValue("@title", titlename);
command.Parameters.AddWithValue("@description", descname);
command.Parameters.AddWithValue("@quantity", "1");

Notes:

• This fixes your SQL injection hole by using parametrized queries. Especially where I see upc.Text, that makes me think that your concatenating user input into your SQL string (very dangerous).
• I changed the word “database” to “tableName” in your query. That is where the name of a table goes, not the database name.
• I neatened up your string declaration a little, so that it is easier to read =)