What query syntax should I use for inserting records in an Oracle database?

Question

I'm a beginner and trying to create a simple program in C# for inserting and updating records in an Oracle database. I have managed to successfully connect to the database but I'm getting an exception for my SQL statement which states that (?) symbol is not supported. Why am I getting this exception and how can I fix this?

My code is:

private void btnSave_Click(object sender, EventArgs e)
{
    OracleConnection con = null;
    try
    {
        con = new OracleConnection();
        string constr = "Data source=XE; User ID=cloudester; Password=cloudester123;";
        if (con.State != ConnectionState.Open)
        {
            try
            {
                con.ConnectionString = constr;
                con.Open();
                //MessageBox.Show("Successfull connection");
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message, "Exception caught");
            }
        }

        if (con.State == ConnectionState.Open)
        {
            string str = "Insert into EMP_DETAIL(EmpId, Name, Age)";
            str += "values (?,?,?)";

            OracleCommand cmd = new OracleCommand();
            cmd.CommandText = Text;
            cmd.Connection = con;
            cmd.Parameters.Add(new OracleParameter("EmpId", OracleDbType.Varchar2)).Value = txtEmpId;
            cmd.Parameters.Add(new OracleParameter("Name", OracleDbType.Varchar2)).Value = txtName;
            cmd.Parameters.Add(new OracleParameter("Age", OracleDbType.Int16)).Value = int.Parse(txtAge.Text);

            cmd.ExecuteNonQuery();
        }
    }
    catch { ... }
}

Answer 1

You need to use the named parameter for your command

string str = "Insert into EMP_DETAIL(EmpId, Name, Age) values (:EmpId, :Name, :Age)";
OracleCommand cmd = new OracleCommand();
cmd.CommandText = str;  //cmd.CommandText = Text; not sure why did you use Text here
cmd.Connection = con;
cmd.Parameters.Add(new OracleParameter("EmpId", OracleDbType.Varchar2)).Value = txtEmpId;
cmd.Parameters.Add(new OracleParameter("Name", OracleDbType.Varchar2)).Value = txtName;
cmd.Parameters.Add(new OracleParameter("Age", OracleDbType.Int16)).Value = int.Parse(txtAge.Text);
cmd.ExecuteNonQuery();

Answer 2

As agent5566 said , and from OracleCommand.Parameters property ;

When using named parameters in an SQL statement called by an OracleCommand of CommandType.Text , you must precede the parameter name with a colon ( : )

Use them like;

using(var con = new OracleConnection(constr))
using(var cmd = con.CreateCommand())
{
   cmd.CommandText = @"Insert into EMP_DETAIL(EmpId, Name, Age)
                       values (:EmpId, :Name, :Age)";
   cmd.Parameters.Add(new OracleParameter("EmpId", OracleDbType.Varchar2)).Value = txtEmpId;
   cmd.Parameters.Add(new OracleParameter("Name", OracleDbType.Varchar2)).Value = txtName;
   cmd.Parameters.Add(new OracleParameter("Age", OracleDbType.Int16)).Value = int.Parse(txtAge.Text);
   con.Open();
   cmd.ExecuteNonQuery();
}

By the way, System.Data.OracleClient has been marked as deprecated in .NET 4 version. You might wanna use Oracle Data Provider for .NET instead.

As an alternative, DataDirect and DevArt also have their own oracle providers for .NET.