Question

is there any probleme with this sql syntax

  @{
var userId = Request["UserId"];
     var db = Database.Open("intranet");
    var query3 = "INSERT INTO CongeAccept(UserId,DateDebut,DateFin,TypeConge) SELECT UserId,DateDebutDemande,DateFinDemande,TypeConge FROM DemandeConge WHERE UserId = '" + userId + "'";
            db.Execute(query3); }

Answer 1

is there any probleme with this sql syntax

It largely depends on where the userID is coming from. If its user supplied you’re opening yourself up to a SQL injection attack

You should use parameters instead. As added bonus you don’t have to worry about putting quotes around the values.

 var query3 = @"INSERT INTO CongeAccept(UserId,DateDebut,DateFin,TypeConge) 
               SELECT UserId,DateDebutDemande,DateFinDemande,TypeConge 
               FROM DemandeConge 
               WHERE UserId = @0";
 db.Execute(query3, userId );