Question

I’m using md5 to ecnrypt the user password. But whenever I try to add any records my code is throwing an error “Syntax error in INSERT INTO statement.”

Here’s my code

    public int InsertUser(string lastName, string firstName, string username, string password, bool isAdmin)
    {
        OleDbConnection conn = new OleDbConnection(connStr);
        conn.Open();

        string encryptPassword = encryptMD5(username,password).ToString();
        OleDbCommand  dCmd = new OleDbCommand("INSERT INTO Users (LastName, FirstName, UserName, Password) " +
                                            "VALUES ('" + lastName + "','" + firstName + "','" + username + "','" + encryptPassword + "')", conn);

        dCmd.CommandType = CommandType.Text;
        try
        {
            return dCmd.ExecuteNonQuery();
        }
        catch
        {
            throw;
        }
        finally
        {
            dCmd.Dispose();
            conn.Close();
            conn.Dispose();
        }
    }

    private string encryptMD5(string username, string sPassword)
    {
        System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider();
        byte[] bs = System.Text.Encoding.UTF8.GetBytes(sPassword + username);
        bs = x.ComputeHash(bs);
        System.Text.StringBuilder s = new System.Text.StringBuilder();
        foreach (byte b in bs)
        {
            s.Append(b.ToString("x2").ToLower());
        }
        return s.ToString();
   }

Answer 1

Try this below, it ensure that all parameters are properly enclosed and escaped.

try
{
    using (OleDbConnection conn = new OleDbConnection(connStr))
    {
        conn.Open();

        string encryptPassword = encryptMD5(username, password).ToString();

        using (OleDbCommand dCmd = new OleDbCommand(
            "INSERT INTO Users (LastName, FirstName, UserName, Password) " +
            "VALUES (?, ?, ?, ?)", conn))
        {
            dCmd.CommandType = CommandType.Text;

            OleDbParameter p;

            dCmd.Parameters.Add(p = new OleDbParameter("@lastName", OleDbType.VarChar));
            p.Value = lastName;

            dCmd.Parameters.Add(p = new OleDbParameter("@firstName", OleDbType.VarChar));
            p.Value = firstName;

            dCmd.Parameters.Add(p = new OleDbParameter("@username", OleDbType.VarChar));
            p.Value = username;

            dCmd.Parameters.Add(p = new OleDbParameter("@encryptPassword", OleDbType.VarChar));
            p.Value = encryptMD5(username, password);

            return dCmd.ExecuteNonQuery();
        }
    }
}
catch
{
    throw; // here should be better exception handling
}