从C＃代码将数据插入SQL Server

Question

I have a table student ( id, name ). Then I have one textbox, for entering the name, when click on submit button, it inserts the data into the database. So how can I insert only to name, not id because id is auto increment?

I tried this

insert into student(id, name) values(,name) 

but it is not insert to my table.

This is my code :

protected void Button1_Click(object sender, EventArgs e)
{
    string test = txtName.Text;

    SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Person.mdf;Integrated Security=True;User Instance=True");

    string sql = "insert into student(name) values ('test')";

    try
    {
        conn.Open();
        SqlCommand cmd = new SqlCommand(sql, conn);
        cmd.ExecuteNonQuery();
    }
    catch (System.Data.SqlClient.SqlException ex)
    {
        string msg = "Insert Error:";
        msg += ex.Message;
    }
    finally
    {
        conn.Close();
    }
}

Answer 1

INSERT INTO student (name) values ('name')

Omit the id column altogether, it will be populated automatically. To use your variable, you should parameterise your SQL query.

string sql = "INSERT INTO student (name) values (@name)";
conn.Open();
SqlCommand cmd = new SqlCommand(sql, conn);
cmd.Parameters.Add("@name", SqlDbType.VarChar);
cmd.Parameters["@name"].Value = test;
cmd.ExecuteNonQuery();

You should never attempt to do this by constructing a SQL string containing the input value, as this can expose your code to SQL injection vulnerabilities.

Answer 2

You better use parameters when you insert data.

try
{
    string sql = "insert into student(name) values (@name)";
    using (SqlConnection conn = new SqlConnection(connectionString))
    {
        conn.Open();
        using (SqlCommand cmd = new SqlCommand(sql, conn))
        {
            cmd.Parameters.AddWithValue("@name", test); // assign value to parameter 
            cmd.ExecuteNonQuery();
        }
    }
}
catch (SqlException ex)
{
    string msg = "Insert Error:";
    msg += ex.Message;
}

Answer 3

您无需在第一部分中提及ID。

insert into student(name) values('name') 

Answer 4

string sql = "INSERT INTO student (name) values (@name)";
conn.Open();
SqlCommand cmd = new SqlCommand(sql, conn);
cmd.Parameters.Add("@name", SqlDbType.VarChar);
cmd.Parameters["@name"].Value = test;
cmd.ExecuteNonQuery();

Answer 5

I was facing this problem and after trying various solution found at stack overflow, i could summarize the experience as follows: commands executed in command shell of mssql like:

insert into table_name (val1,val2,val3,val4) VALUES ("val1","val2",0,"val4")

go

or

insert into table_name VALUES ("val1","val2",0,"val4")

go

work when typed directly in the mssql database prompt,

But when it is required to use the the insert statement from c#, it is required to be kept in mind that string needs to be surrounded by an additional pair of single quites, around the strings, like in:

SqlConnection cnn;

string connetionString = "Data Source=server_name;Initial Catalog=database_name;User ID=User_ID;Password=Pass_word";

cnn = new SqlConnection(connetionString);

SqlCommand myCommand = new SqlCommand("insert into table_name (val1,val2,val3,val4) VALUES ('val1','val2',0,'val4');", cnn);

//or
//SqlCommand myCommand = new SqlCommand(insert into table_name VALUES ('val1','val2',0,'val4');", cnn);

cnn.Open();

myCommand.ExecuteNonQuery();

cnn.Close();

the problem here is that most people, like myself, try to use <\\"> in the place of double quotes <">that is implemented as in the above command line case, and SQL executor fails to understand the meaning of this.

Even in cases where a string needs to be replace, ensure that strings are surrounded by single quotation , where a string concatination looks like a feasible solution, like in:

SqlCommand myCommand = new SqlCommand("insert into table_name (val1,val2,val3,val4) VALUES ('"+val1+"','val2',0,'val4');", cnn);

Answer 6

Try the following query,

insert into student(name) values(name) 

SQL Server internally auto increments the id column when u insert the data since u said it is auto increment. If it is not working, the u have to check the identity column in the db.

Answer 7

use the key word "identity" to auto increment the id column

Refer : http://technet.microsoft.com/en-us/library/aa933196(v=sql.80).aspx

create table table_name( id int PRIMARY KEY IDENTITY ) 

and you no need to mention the "id" in the insert query