如何将文本框中的文本绑定到具有IDENTITY（1、1）的SQL Server表

Question

Just like in title (C#, Visual Studio 2015).

I have a Database.mdf file in Visual Studio. I have 5 texboxes and I want to bind the text from this texboxes to database tables.

My primary key has an IDENTITY(1,1) attribute. I don't know how I can resolve this problem. Binding should be pressing by the button click.

 SqlConnection conn = new SqlConnection(@"Data Source = (LocalDB)\MSSQLLocalDB; AttachDbFilename = C:\Users\Mariusz\Desktop\SerwisKomputerowyDB\SerwisKomputerowyDB\SerwisKomputerowyDB\Database1.mdf; Integrated Security = True");
 conn.Open();

 SqlCommand newCmd = conn.CreateCommand();
 newCmd.Connection = conn;
 newCmd.CommandType = CommandType.Text;
 newCmd.CommandText = "INSERT INTO [dbo].[KlienciIndywidualni] VALUES (,'" + textBox1.Text + "','" + textBox2.Text + "','" + textBox3.Text + "','" + textBox4.Text + "','" + textBox5.Text + "')";

 newCmd.ExecuteNonQuery();

 conn.Close();

Sorry for my english.

Answer 1

If you have a table with an IDENTITY column, you need to make sure NOT to insert a value into that column when you insert data.

So you need to explicitly define the column names you insert into - which is really always a good idea and you should do this always, anyway:

// define query WITH PARAMETERS! Don't concatenate together your SQL - never EVER !
string insertQry = "INSERT INTO [dbo].[KlienciIndywidualni] (TextCol1, TextCol2, TextCol3, TextCol4, TextCol5) " + 
                   "VALUES (@TextValue1, @TextValue2, @TextValue3, @TextValue4, @TextValue5);";

// create connection and command object                   
using (SqlConnection conn = new SqlConnection(@"Data Source = (LocalDB)\MSSQLLocalDB; AttachDbFilename = C:\Users\Mariusz\Desktop\SerwisKomputerowyDB\SerwisKomputerowyDB\SerwisKomputerowyDB\Database1.mdf; Integrated Security = True"))
using (SqlCommand cmd = new SqlCommand(insertQry, conn))
{
    // set up parameters and define values
    cmd.Parameters.Add("@TextValue1", SqlDbType.VarChar, 50).Value = textBox1.Text;
    cmd.Parameters.Add("@TextValue2", SqlDbType.VarChar, 50).Value = textBox2.Text;
    cmd.Parameters.Add("@TextValue3", SqlDbType.VarChar, 50).Value = textBox3.Text;
    cmd.Parameters.Add("@TextValue4", SqlDbType.VarChar, 50).Value = textBox4.Text;
    cmd.Parameters.Add("@TextValue5", SqlDbType.VarChar, 50).Value = textBox5.Text;

    // open connection, execute INSERT command, close connection  
    conn.Open();
    cmd.ExecuteNonQuery();
    conn.Close();
}
}    

Answer 2

You have to use the insert statement with column names eg

INSERT INTO [dbo].[KlienciIndywidualni](column2, column3) VALUES (value2, value3)";

Refer w3school article - SQL INSERT INTO Statement

To prevent sql injection vulnerability check this Reference ie by concatenating values, use parameterized queries. eg

newCmd.CommandType = CommandType.Text;
newCmd.CommandText = "INSERT INTO [dbo].[KlienciIndywidualni](column2, column3) VALUES (@val1, @val2)";
newCmd.Parameters.AddWithValue("@val1", textBox1.Text);
newCmd.Parameters.AddWithValue("@val2", textBox2.Text);
newCmd.ExecuteNonQuery();

Answer 3

string insertQry = "INSERT INTO [dbo].[KlienciIndywidualni] (Imię, Nazwisko, Telefon, E-mail,Adres) " +
                           "VALUES (@Imię, @Nazwisko, @Telefon, @E-mail, @Adres);";


using (SqlConnection conn = new SqlConnection(@"Data Source=(LocalDB)\MSSQLLocalDB;AttachDbFilename=C:\Users\Mariusz\Desktop\AplikacjaNaInzynierie\AplikacjaNaInzynierie\Baza.mdf;Integrated Security=True"))
    using (SqlCommand cmd = new SqlCommand(insertQry, conn))
    {
        cmd.Parameters.Add("@Imię", SqlDbType.VarChar, 50).Value = textBox1.Text;
        cmd.Parameters.Add("@Nazwisko", SqlDbType.VarChar, 50).Value = textBox2.Text;
        cmd.Parameters.Add("@Telefon", SqlDbType.VarChar, 50).Value = textBox3.Text;
        cmd.Parameters.Add("@E-mail", SqlDbType.VarChar, 50).Value = textBox4.Text;
        cmd.Parameters.Add("@Adres", SqlDbType.VarChar, 50).Value = textBox5.Text;

        conn.Open();
        cmd.ExecuteNonQuery();
        conn.Close();
    }

I still have error...