Retrieving ID from table C#

Question

I want to retrieve the 'ReceiverID' from the 'Receiver' table when inserting a 'Cname' and place the ID into Visitor while I am filling the Visitor table. How can i retrieve this ID? i can find it in my database but I want it to auto. fill in the Visitor table. (Im new to all of this)

        try
        {
            string connStr = ConfigurationManager.ConnectionStrings["ParkingBase"].ConnectionString;

            using (SqlConnection connection = new SqlConnection(connStr))
            {
                connection.Open();
                SqlCommand cmd = connection.CreateCommand();
                cmd.CommandType = CommandType.Text;

                string Cname = TxtCname.Text;
                string FirstName = TxtFname.Text;
                string MiddleName = TxtMname.Text;
                string LastName = TxtLname.Text;
                string PhoneNumber = TxtPhoneNumber.Text;
                //(some variable for ReceiverID)

                cmd.CommandText = "INSERT INTO Receiver(Cname) " +
                    "values('" + Cname + "')";
                cmd.ExecuteNonQuery();

                cmd.CommandText = "INSERT INTO Visitor(FirstName, MiddleName, LastName, PhoneNumber,ReceiverID)" +
                    "values('" + FirstName + "', '" + MiddleName + "', '" + LastName + "', '" + PhoneNumber + "','"ReceiverID"')";
                cmd.ExecuteNonQuery();
                connection.Close();
            }
        }
        catch (Exception)
        {
            throw;
        }
    }`

Answer 1

You should write a parameterized query appending the SELECT SCOPE_IDENTITY() after the first insert. With simple queries like these there is no need to write a stored procedure and having two points to worry for maintenance.

cmd.CommandText = "INSERT INTO Receiver(Cname) values(@cname);
                   SELECT SCOPE_IDENTITY()";
cmd.Parameters.Add("@cname", SqlDbType.NVarChar).Value = cName;
int receiverID = Convert.ToInt32(cmd.ExecuteScalar));

Now you can write the second insert statement (again using a parameterized query)

cmd.Parameters.Clear();
cmd.CommandText = @"INSERT INTO Visitor
       (FirstName, MiddleName, LastName, PhoneNumber,ReceiverID)
       values(@first, @middle, @last,@phone,@receiver)";
cmd.Parameters.Add("first", SqlDbType.NVarChar).Value = FirstName;
....
cmd.Parameters.Add("receiver", SqlDbType.Int).Value = receiverID;
cmd.ExecuteNonQuery();

Answer 2

you can change your comment test and use scope identity after insert and then you use ExecuteScalar() to get this id . Better to use SP in such case.

    /// change here 

           cmd.CommandText = "INSERT INTO Receiver(Cname) " +
                "values('" + Cname + "') ;select SCOPE_IDENTITY()"; 
         var newID= Convert.ToInt32( cmd.ExecuteScalar());

     --- better solution suggested by Steve is below -- I didnt tested this but this is approach .

 using (var cmd = new SqlCommand(@"INSERT INTO Receiver(Cname) VALUES (@cname)", conn))
    {
        cmd.Parameters.AddRange(
            new[]
                {
                    new SqlParameter(@"cname", SqlDbType.VarChar).Value = cname
                });
        conn.Open();
        cmd.ExecuteNonQuery();
    }

Answer 3

Your code is insanely vulnerable to SQLInjection attack - someone is able to type into your textboxes SQL and have it executed on your database.

You can fix this, and your actual question by converting everything to a stored procedure, or using parameterized queries.

To get an identity back after an insert you use SCOPE_IDENTITY() method.

Your stored proc would look something like this (Note i dont know your data types so im guessing a bit):

CREATE PROC dbo.InsertVisitor
   @CName NVARCHAR(100),
   @FName NVARCHAR(100),
   @MName NVARCHAR(100),
   @LName NVARCHAR(100),
   @PhoneNumber NVARCHAR(100)
AS
BEGIN
    DECLARE @receiverId INT

    INSERT INTO Cname (Receiver) VALUES (@CName)
    SET @receiverId = SCOPE_IDENTITY();

    INSERT INTO Visitor (FirstName, MiddleName, LastName, PhoneNumber,ReceiverID)
    VALUES(@FName,@MName,@LName,@PhoneNumber,@receiverId)
END 

Changes to your code are simply converting to call a stored proc instead of inline sql

SqlCommand cmd = connection.CreateCommand();
cmd.CommandType = CommandType.StoredProcedure;
cmd.CommandText = "dbo.InsertVisitor";
cmd.Parameters.Add("@CName",SqlDbType.NVarChar).Value = TxtCname.Text;
// snip.. other parameters
cmd.ExecuteNonQuery();