在SQL语句中使用ComboBox选择

Question

I would like to insert a number, for example 112, into a table cell. The column should be selected from a ComboBox. For example, if combobox1 text is "name", then data should be inserted into column "name" in table1.

The code below does not seem to work:

cmd.CommandText = "INSERT INTO table1 ('" + combobox1.SelectedItem + "') values ('" + txtbox1.Text + "')";

With a hardcoded column name it works:

cmd.CommandText = "INSERT INTO table1 (name) values ('" + txtbox1.Text + "')";

How can i insert the ComboBox selection into the statement?

Answer 1

Use parameters to protect against SQL Injection . Do not add ' for column name.

cmd.CommandText = "INSERT INTO table1 (" + combobox1.SelectedItem.ToString() + ") values (@VALUE)";
cmd.Parameters.AddWithValue("@VALUE", txtbox1.Text);