Question

Sql Command construction

I’ve built the Sql command as follows:

    string _InsertVehicleQuery = "INSERT INTO VSI_VehicleRecords(StockNumber,Status,Make,Model,Colour,Spefication) VALUES (@StockNumber, @Status, '@Make', '@Model', '@Colour', '@Specification');";

    SqlCommand _InsertVehicleCommand = new SqlCommand(_InsertVehicleQuery);
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@StockNumber", __StockNumber));
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@Status", __Status));
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@Make", Make));
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@Model", Model));
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@Colour", Colour));
    _InsertVehicleCommand.Parameters.Add(new SqlParameter("@Specification", Specification));

Sql Command execution

    //Method call
    DataUtility.NonQuery(_InsertVehicleCommand);

    //Method structure
    public static void NonQuery(SqlCommand Command)
    {
        Command.Connection = __Connection;

        OpenConnection();
        Command.ExecuteNonQuery();
        CloseConnection();
    }

Is there anything blindingly obvious that i’m not doing within the execution or construction of the SQL Query. The result that I get in the database table:

VehicleRecordID StockNumber Status  Make    Model   Colour  Spefication
1                 -1            0   @Make   @Model  @Colour @Specification

Thanks in advance for any solution, also any suggestions are also welcomed!

Answer 1

The parameter names should not be in single quotes in the VALUES list as they will be interpreted as string literals.