Question

I’m attempting to insert an array into a SQL Server database. 1/4 is copied to the database before I receive the error:

Incorrect syntax near ‘s’. Unclosed
quotation mark after the character
string ‘, ‘)’.

Here is the button click event –

private void button3_Click(object sender, EventArgs e)
{
   SqlConnection sql = new SqlConnection("server=localhost; uid=xxxx; pwd=xxxx; database=Movies;");
   sql.Open();

   for (int i = 0; i < jointArray.Length; i++)
   {
      SqlCommand command = new SqlCommand("insert into [" + folderName + "] " + "values('" + jointArray[i].ToString() +"', '')", sql);
      command.ExecuteNonQuery();
   }

   sql.Close();
}

Answer 1

I would hazard a guess that a 1/4 of the way through jointArray[i].ToString() contains an apostrophe.

So instead of a SQL query that looks like this..

insert into [MyFolder] values('MyValue')

you end up with something that looks like this

insert into [MyFolder] values('MyValue's')

which causes the error (notice where incorrect syntax near the s is!)

Please consider using parameters with your SQLCommand (look up Parameters.Add and Parameters.AddWithValue).

Using Parameters makes your code

• More readable
• Easier to debug
• Less prone to SQL injection attacks (which recently got Sony Pictures hacked)