insert Image in database

Question

I am new to asp.net and databases! I am trying to save image into database from the file upload control. i have tried it but it isn't working that is upon clicking the submit button, the data does not get added into the database neither showing any error! this is the code which I have tried

protected void ButtonSubmit_Click(object sender, EventArgs e)
{         
    if (FileUpload1.HasFile && Page.IsValid)                //fileUpload and submit
    {
        string fileExtension = System.IO.Path.GetExtension(FileUpload1.FileName);

        if (fileExtension.ToLower() != ".jpg")
        {
            Labelupload.Text = "Only Files with .jpg extension are allowed";
            Labelupload.ForeColor = System.Drawing.Color.Red;
        }
        else
        {
            FileUpload1.SaveAs(Server.MapPath("~/Uploads/" + FileUpload1.FileName));
            Labelupload.Text = "File Uploaded";
            Labelupload.ForeColor = System.Drawing.Color.DeepSkyBlue;

            LabelSubmit.Text = "Submitted Succesfully";
            LabelSubmit.ForeColor = System.Drawing.Color.DeepSkyBlue;
        }
    }
    else
    {
        Labelupload.Text = "Please select a file";
        Labelupload.ForeColor = System.Drawing.Color.Red;
        LabelSubmit.Text = "Failed to Submit";
        LabelSubmit.ForeColor = System.Drawing.Color.Red;
    }

    // insert into database
    Work obj = new Work();

    /* Stream fs = FileUpload1.PostedFile.InputStream;
    BinaryReader br = new BinaryReader(fs);
    Byte[] bytes = br.ReadBytes((Int32)fs.Length);*/

    obj.listItem_1 = DropDownList1.SelectedValue;
    obj.listItem_2 = DropDownList2.SelectedValue;
    obj.Description = TextBoxdescription.Text;
    obj.Date = TextBoxdate.Text;
    //obj.UploadedImage = bytes;

    int k = obj.insertmethod();

    TextBoxdescription.Text = "";   
}

Here is the Work class that contains the insertmethod() logic:

public class Work
{
    Clssqlconnection obj = new Clssqlconnection();

    public string listItem_1 { get; set; }
    public string listItem_2 { get; set; }
    public string Description { get; set; }
    public string Date { get; set; }
    //public Byte[] UploadedImage { get; set; }

    public int insertmethod()
    {
        obj.str = @"insert into [assign_Work] (listItem_1, listItem_2, Description, Date, UploadedImage)" +
             "values('" + listItem_1 + "','" + listItem_2 + "','" + Description + "','" + Date + "','" + UploadedImage + "')";
        return obj.ExecuteNonQuery();
    }
}

Answer 1

The image needs to go into the database via a parameter. You cannot have it in a raw SQL statement. Try this:

public int insertmethod()
{

    obj.str = @"insert into [assign_Work] (listItem_1, listItem_2, Description, Date, UploadedImage)" +
         "values('" + listItem_1 + "','" + listItem_2 + "','" + Description + "','" + Date + "', ?)";
    obj.Parameters.AddWithValue("File", UploadedImage);

    return obj.ExecuteNonQuery();


}

Also, btw, you might want to consider using parameters for all of these values to avoid injection attacks. For instance, what if your Description field had an apostrophe in it?