Question

MySqlCommand cmd = new MySqlCommand
                    (@"INSERT INTO Table(field) VALUES('somevalue');" +
                    "SELECT * FROM table",cn);

This works fine to me since I’m only passing those statements to my MySQL server.

Is it OK to use ExecuteReader() when inserting & updating & deleting?

I usually use ExecuteNonQuery() on those.

Answer 1

You’re just fine bundling the extra INSERT in along with your SELECT with ExecuteReader(). This is okay.

I do see two things that are potentially not okay… nothing in the code itself, but what you showed is simplified, and the simplified code hints at some potential poor practices:

The first not okay is that your code looks like it might be using string concatenation to substitute values into your query. Something like this:

MySqlCommand cmd = new MySqlCommand
                (@"INSERT INTO Table(field) VALUES('" + somevariable + "');" +
                "SELECT * FROM table",cn);

That is a huge problem, as it opens a gaping security hole in your application. Instead, you need to use query parameters, so the code looks more like this:

MySqlCommand cmd = new MySqlCommand
                (@"INSERT INTO Table(field) VALUES(@somevalue);" +
                "SELECT * FROM table",cn);
cmd.Parameters.Add("@somevalue", SqlDbType.VarChar, 50).Value = somevariable;

The other potential problem is that your command and, more importantly, your connection, should be wrapped in a try/finally block (or for preference a using block), like this:

using (var cn = new MySqlConnection("..."))
using (var cmd = new MySqlCommand("@INSERT INTO Table(field).... ", cn))
{
    cmd.Parameters.Add(...);
    cn.Open();
    using (var rdr = cmd.ExecuteReader())
    {
        while (rdr.Read())
        {
            //...
        }
    }
}