Insert Data into SQL table using Javascript and ASP.NET

Question

Im using Microsoft Visual Studio 2012 as platform and i have created Web Forms Project i have created data base file "SimpleDB.mdf" inside his "Table" folder i added new table called "Table" which has two columns - id and Name(string).What im trying is to insert string data into Name column of this table while calling server side function from javascript function.

This is the aspx.cs code

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Web.Services;

namespace ProjectWWW
{
    public partial class WebForm1 : System.Web.UI.Page
    {
        [WebMethod]
        public static string InsertData(string ID){
            string source = "Data Source=(LocalDB)\v11.0;Integrated Security=True;Connect Timeout=30";
            SqlConnection con = new SqlConnection(source); 
            {

               SqlCommand cmd = new SqlCommand("Insert into Table(Name) values('" + ID + "')", con);
                {
                    con.Open();
                    cmd.ExecuteNonQuery();
                    return "True";
                }
            }
        }
}

and this is the aspx code

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="WebForm1.aspx.cs" Inherits="ProjectWWW.WebForm1" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">   
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <script>
        function CallMethod() {
            PageMethods.InsertData("hello", CallSuccess, CallError);
        }

        function CallSuccess(res) {
            alert(res);
        }

        function CallError() {
            alert('Error');
        }
    </script>
</head>

    <body>
        <header>        
        </header>       
        <div class="table"  id="div1" > </div>                      
        <form id="Form1" runat="server">
            <asp:Button id="b1" Text="Submit" runat="server" onclientclick="CallMethod();return false;"/>
            <asp:ScriptManager enablepagemethods="true" id="ScriptManager1" runat="server"></asp:ScriptManager>
        </form> 

    </body>


   </html>

So basically im expecting when the button submit is clicked the Table Column "Name" will be filled with "Hello" but nothing happens and the column stays empty(NULL)

Answer 1

Table is reserved word in T-SQL so i would suggest you to use [] square brackets to enclose the Table .

Try This:

SqlCommand cmd = new SqlCommand("Insert into [Table](Name) 
                                                   values('" + ID + "')", con);

Suggestion: Your query is open to sql injection attacks.I would suggest you to use Parameterised Queries to avoid them.

Try This:

using(SqlConnection con = new SqlConnection(source))
{
    using(SqlCommand cmd = new SqlCommand("Insert into [Table](Name)
                                                     values(@Name)", con))
    {            
        con.Open();
        cmd.Parameters.AddWithValue("@Name",ID);
        cmd.ExecuteNonQuery();
        return "True";
    }
}

Insert Data into SQL table using Javascript and ASP.NET

Question

1 answers

solution1
0 2014-06-30 15:44:05

Insert Data into SQL table using Javascript and ASP.NET

Question

1 answers

solution1 0 2014-06-30 15:44:05

solution1
0 2014-06-30 15:44:05