插入语句错误vb.net

Question

following is the code which is use to enter datagridview items into the table.

    Dim X As DataGridViewRow

    grnno = 123123
    glocation = txtlocation.Text
    gsupplier = txtsupplier.Text
    greceivedby = txtreceivedby.Text
    greceiveddate = txtreceiveddate.Text
    grn_status = cmbstatus.SelectedItem
    ggrossamt = txtgrossamt.Text
    gdiscountamount = txtdiscount.Text
    gtotalnetamount = txttotalnet.Text
    sqlstr = "INSERT INTO POS_GRN_HDR(loc_code,supplier_code,created_by,created_Date,grn_status,gross_amt,disc_Amt,net_Amt) values('" & glocation & "','" & gsupplier & "','" & greceivedby & "','" & greceiveddate & "','" & grn_status & "'," & ggrossamt & "," & gdiscountamount & "," & gtotalnetamount & " )"
    sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
    sqlcmd.ExecuteNonQuery()
    For Each X In datagridItems.Rows

        sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "','" & X.Cells(6).Value & "','" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"
        sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
        sqlcmd.ExecuteNonQuery()
    Next

the error is in the 2nd insert statement, it gives error cannot convert string to integer.. the cells from x.cell(6) are of integer type and in database also its integer type, now I want to ask should I enclose it in single quotations or not, as enclosing in single quotations give such errors like syntax '' and in double quotations it gives like cannot convert string to int type.please tell where I am doing wrong.

Answer 1

First of all use parametrized queries! It is safer and also more readable. You are passing some value as string but should be integer.

sqlstr = "INSERT INTO POS_GRN_HDR(loc_code,supplier_code,created_by,created_Date,grn_status,gross_amt,disc_Amt,net_Amt) _
values(@glocation, @gsupplier, @greceivedby, @greceiveddate, @grn_status, @ggrossamt, @gdiscountamount, @gtotalnetamount)"

sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
sqlcmd.Parameters.AddWithValue("@glocation", glocation) 
sqlcmd.Parameters.AddWithValue("@gsupplier", gsupplier) //and so on


For Each X In datagridItems.Rows

  sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) _
            VALUES(@grnno, @item_code, @description, ...)"

  sqlcmd = New SqlClient.SqlCommand(sqlstr, AppsCon)
  sqlcmd.Parameters.AddWithValue("@grnno", grnno)
  sqlcmd.Parameters.AddWithValue("@item_code", CType(X.Cells(0).Value, Integer)) //cast to proper type      

  sqlcmd.ExecuteNonQuery()

Next

Answer 2

Remove the single quote marks ''

For example (and referring only to x.cell(6) as per your post) use " & X.Cells(6).Value & "

    sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "', " & X.Cells(6).Value & ",'" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"

You may also need to cast it (assuming it's always going to have a numeric value)

" & CInt(X.Cells(6).Value) &"

I will assume you know of SQL injection and this method of updating a database is generally 'outdated' and 'bad practice' now and you should use parameters instead ...

Updated

Since there is a possibility of a null (and you want it to be a 0 where this is the case), you could use something like (not tested as I'm not a VB person)

dim cellSix as integer
if IsNothing(X.Cells(6).Value then 
    cellSix = 0
else
    cellSix = CInt(X.Cells(6).Value)
end if

sqlstr = "INSERT INTO POS_GRN_DTL(GRN_KEY,ITEM_CODE,DESCRIPTION,TYPE,UOM,BATCH_NO,EXPIRY_DATE,RECEIVED_QTY,UNIT_PRICE,AMOUNT,DISCOUNT,NET_AMOUNT) VALUES('" & grnno & "','" & X.Cells(0).Value & "','" & X.Cells(1).Value & "','" & X.Cells(2).Value & "','" & X.Cells(3).Value & "','" & X.Cells(4).Value & "','" & X.Cells(5).Value & "', " & cellSix & ",'" & X.Cells(7).Value & "' ,'" & X.Cells(8).Value & "','" & X.Cells(9).Value & "','" & X.Cells(10).Value & "')"

Or, to keep the code shorter you could use the IIF

cellSix = IIf(isnothing(CInt(X.Cells(6).Value)), 0,  CInt(X.Cells(6).Value))