Getting Error When Insert data in Ms access 2007 using C#

Question

Here is My code . when ever i enter data in TextBox3 and TextBox4 without special characters its fine and when i enter data which contain special characters such as ",.;:#". please give me solution thank you

   OleDbCommand cmd = new OleDbCommand();

   OleDbConnection mycon = new OleDbConnection();

   mycon.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Users\AGENTJ.AGENTJ-PC\Documents\Visual Studio 2010\WebSites\mfaridalam\App_Data\mfaridalam1.accdb";

   cmd = mycon.CreateCommand();

   mycon.Open();
   cmd.CommandText = "INSERT INTO [Image] ([Image],[Sort],[Created],[Albumid],[Description],[title])VALUES('" + filename + "','" + ips + "','" + dateTime.ToString("dd/MM/yyyy") + "','" + newtable + "','" + TextBox4.Text + "','" + TextBox3.Text + "')";


    cmd.ExecuteNonQuery();

Answer 1

Using a parameterized query will help avoid these types of quoting errors, and will also protect the application from SQL injection attacks and other strange behaviours. They are slightly less compact to code, but they are well worth the effort.