How to insert decimal value from textbox into database with c#

Question

I'm using a SQL Server database and Windows Forms application. I have 2 textboxes and 1 combobox. Users inputs their name and working rate into the textboxes and they chose year from combobox. I try to insert those values into my database.

EX:

2018    Mike    39,72     WORKERS

In database:

year --> nvarchar(4)
name --> nvarchar(50)
rate --> decimal(18,2)
type --> nvarchar(50)

My code is like:

SqlCommand cmd = new SqlCommand("INSERT INTO USERS(YEAR,NAME,RATE,TYPE) VALUES ('" + yearcombo.Text + "','" + name.Text + "','" + Convert.ToDecimal(rate.Text, CultureInfo.CurrentCulture) + ",'" + "WORKERS" + "')", connection);

I get this error:

There are fewer columns in the INSERT statement than values specified in the VALUES clause. The number of values in the VALUES clause must match the number of columns specified in the INSERT statement.

Answer 1

This kind of insert is vulnerable to injection and as you have already discovered it is hard to add values like decimal, DateTime, ... to add columns, use Parameters.Add

SqlCommand cmd = new SqlCommand("INSERT INTO USERS(YEAR,NAME,RATE,TYPE) VALUES (@year, @name,@rate,@type)", connection);

cmd.Parameters.Add("@year", SqlDbType.Int).Value = int.Parse(yearcombo.Text);
cmd.Parameters.Add("@name", SqlDbType.VarChar).Value = name.Text;
cmd.Parameters.Add("@rate", SqlDbType.Decimal).Value = Convert.ToDecimal(rate.Text, CultureInfo.CurrentCulture);
cmd.Parameters.Add("@type", SqlDbType.VarChar).Value = "WORKERS";

Imagine that somebody changes the yearcombo value (as simply as using inspect element in chrome for example) and set it to:

"2019,'a',1,'Something');insert into ARESTRICTEDTABLE(somefield) values('somecolumn'); update AnotherTable set SomeField = 'somevalue');, insert into users(year,name,rate,type),(2019,"

then your command text would be:

"insert into users (year,name,rate,type) (2019,'a',1,'Something');insert into ARESTRICTEDTABLE(somefield) values('somecolumn'); update AnotherTable set SomeField = 'somevalue');, insert into users(year,name,rate,type),(2019," ,'" + name.Text + "','" + Convert.ToDecimal(rate.Text, CultureInfo.CurrentCulture) + ",'" + "WORKERS" + "')"

Answer 2

You should use SqlParameter with a query containing parameters : It should be like this :

SqlCommand cmd = new SqlCommand("INSERT INTO USERS(YEAR,NAME,RATE,TYPE) VALUES (@YEAR, @NAME, @RATE, @TYPE)", connection);
cmd.Parameters.Add(new SqlParameter("@YEAR", yearcombo.Text));
cmd.Parameters.Add(new SqlParameter("@NAME", name.Text));
cmd.Parameters.Add(new SqlParameter("@RATE", Convert.ToDecimal(rate.Text, CultureInfo.CurrentCulture)));
cmd.Parameters.Add(new SqlParameter("@TYPE", "WORKERS"));

I didn't test it but it convert your parameter to a correct decimal for your query. Also it is better to use SqlParameter for security issues (preventing SQL Injection )