插入SQL Server数据库ASP.net

Question

What I'm trying to do is to insert a username, and their monthly hour limit to my SQL Server database. I've used the automatically generated statements for updating and deleting. I just need to add in new users now. The code below, should work as far as I know, but it doesn't. I think it's the way I've written it.

The part in comments is what the Userdata.aspx file automatically generated, so I'm trying to convert it to use my 2 text boxes.

Thanks a lot.

protected void Button1_Click1(object sender, EventArgs e)
{
     string sql = "INSERT INTO [UserData]([UserName], [MonthlyHourLimit]) VALUES ("+ TextBox1.Text + "," + TextBox2.Text + ")";

     //INSERT INTO [UserData] ([UserName], [MonthlyHourLimit]) VALUES (@UserName, @MonthlyHourLimit)" 
     SqlDataSource1.InsertCommand = sql;
     GridView1.DataBind();
}

Answer 1

You need to configure your data source to use parameters.

 <asp:sqlDataSource ID="EmployeeDetailsSqlDataSource" 
   SelectCommand="select [UserName], [MonthlyHourLimit] from [UserData] where UserName= @UserName"

   InsertCommand="IINSERT INTO [UserData] ([UserName], [MonthlyHourLimit]) VALUES (@UserName, @MonthlyHourLimit);"

   ConnectionString="<%$ ConnectionStrings:MyConnection %>"
   RunAt="server">

   <SelectParameters>
      <asp:Parameter Name="UserName" Type="Int32" DefaultValue="0" />
   </SelectParameters>

   <InsertParameters>
      <asp:Parameter Name="UserName" Direction="Input" Type="String" />
      <asp:Parameter Name="MonthlyHourLimit" Direction="Input" Type="String" />
   </InsertParameters>

 </asp:sqlDataSource>

UPDATE:I've forgot to mention, you would like to use ControlParameter and not simple Parameter. Take a look at following snippet:

  <asp:СontrolParameter Name="UserName" ControlId="ddlUserNames" PropertyName="SelectedValue"/>

  ...

  <asp:DropdownList
      ID="ddlUserNames"
      runat="server"
      Autopostback="True">
      <asp:Listitem Selected="True">Users</asp:Listitem>
      <asp:Listitem Value="Peter">Peter</asp:Listitem>
      <asp:Listitem Value="Jessica">Jessica</asp:Listitem>
  </asp:Dropdownlist>

Take a look at corresponding MSDN page describing usage of SqlDataSource in details.

UPDATED 2: complete example in order to avoid confusion

 <asp:sqlDataSource ID="EmployeeDetailsSqlDataSource" 
                    SelectCommand="select [UserName], [MonthlyHourLimit] from [UserData] where UserName= @UserName"
                    InsertCommand="IINSERT INTO [UserData] ([UserName], [MonthlyHourLimit]) VALUES (@UserName, @MonthlyHourLimit);"

                    ConnectionString="<%$ ConnectionStrings:MyConnection %>"
                    RunAt="server">
      <SelectParameters>
          <asp:Parameter Name="UserName" Type="Int32" DefaultValue="0" />
      </SelectParameters>
      <InsertParameters>
          <asp:ControlParameter Name="UserName" ControlId="txtUserName" Direction="Input" Type="String" />
          <asp:ControlParameter Name="MonthlyHourLimit" ControlId="txtMonthlyHourLimit" Direction="Input" Type="String" />
      </InsertParameters>
 </asp:sqlDataSource>

 <asp:TextBox runat="server" ID="txtUserName" /> 
 <asp:TextBox runat="server" ID="txtMonthlyHourLimit" />

Answer 2

Datasource.InsertCommand is a property.
Datasource.Insert() is a method.

You should also use parameters.

datasource.insertparameters("username").defaultvalue = TextBox1.Text + "," + TextBox2.Text