我想将数据插入数据库

Question

I want insert the data into the database.

string pa = "4898";  
string equery="Insert into Users(pas)values('"+pa+"')";

while I inserting the data to the database,its says string or binary data would be truncated the statement has been terminated. So I changed nvarchar(50) into nvarchar(max) in the table.

And these statement has been executed and saved in the database of unreadable format like 傉䝎਍ਚ this. And how can be over come this problem and save the data in the database as "4898".

private void save_Click(object sender, EventArgs e)
{
    string password = "4898";
    string equery="Insert into Users(name,gender,dateofbirth,age,fathername,
                                      address,citiy,state,country,zipcode,
                                      mobile,phone,email,jobtitle,
                                      dateofjoin,pic,passwords)
                             values('"+nametxt.Text.ToString().Trim()+"',
                                     @gender,
                                     '"+dateofbirth.Text.ToString().Trim()+"',
                                     '"+age.Value.ToString().Trim()+"',
                                     '"+fathertxt.Text.ToString().Trim()+"',
                                    '"+addresstxt.Text.ToString().Trim()+"',
                                  '"+citiytxt.Text.ToString().Trim()+"',
                                  '"+statetxt.Text.ToString().Trim()+"',
                                  '"+country.Text.ToString().Trim()+"',
                                  '"+ziptxt.Text.ToString().Trim()+"',
                                  '"+mobiletxt.Text.ToString().Trim()+"',
                                  '"+phonetxt.Text.ToString().Trim()+"',
                                  '"+emailtxt.Text.ToString().Trim()+"',
                                  '"+jobtxt.Text.ToString().Trim()+
                                  "','"+dateofjoin.Text.ToString().Trim()+"',
                                  '"+password+"',@pic)";
    SqlCommand cmd = new SqlCommand(equery, con);

    if(male.Checked)
        cmd.Parameters.AddWithValue("@gender","Male");
    else
        cmd.Parameters.AddWithValue("@gender","Female");

    MemoryStream stream = new MemoryStream();
    pictureBox1.Image.Save(stream,System.Drawing.Imaging.ImageFormat.Png);
    byte[] pic = stream.ToArray();
    cmd.Parameters.AddWithValue("@pic", pic);

    try
    {
        con.Open();
        cmd.ExecuteNonQuery();
        MessageBox.Show("Saved Successfully");
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message);
    }
    finally
    {
        con.Close();
    }

    MessageBox.Show("Saved Successfully");
    idtxt.Text = "";
    nametxt.Text = "";
    age.Value = Convert.ToDecimal(null);
    male.Checked = false;
    female.Checked = false;
    dateofbirth.Text = "";
    fathertxt.Text = "";
    addresstxt.Text = "";
    citiytxt.Text = "";
    statetxt.Text = "";
    country.Text = "";
    ziptxt.Text = "";
    mobiletxt.Text = "";
    phonetxt.Text = "";
    emailtxt.Text = "";
    dateofjoin.Text = "";
    jobtxt.Text = "";
    pictureBox1.Image = null;
}

Answer 1

Looking at your insert statement:

"Insert into Users(... pic,passwords) values (... '"+password+"',@pic)";

it seems that you interchanged pic and passwords .

---

Also, as others already pointed out in the comments, you should use only parameterised queries (to prevent SQL Injection), especially when handling text inserted by an user or any other untrusted source.

Answer 2

There is a Logical error in your code. Interchange

'"+password+"',@pic)";

in your string equery. By the way a suggestion! It is better to use 'linq to Sql' rather than query pass method! Because 'Linq to Sql' does every thing for you. you just have to give values :)