C# and sql database

Question

Hi I am new to programming and this forum as well. I am actually working on a windows application with C#. I have encountered a problem which I am not able to solve even after googling for 2 days. It might be a simple thing for all you experts. I am trying to save the filepath in to the sql server table column. I have made this column of datatype nvarchar(max). This filepath is picked up by the openfiledialog object and then I have put it in a textbox. The insert query I am using in my data access layer is working just fine with other modules however this filepath is creating an error. Even if I assign the whole path to a string variable and pass that variable in to the query it still doesn't work. Here is my query string sqlquery = INSERT INTO [Costing] ([Date] [xlsdirectory] [xlsname] [xlsext] [xls] [Amount]) VALUES (' + date + ' ' + xlsdir + ' ' + xlsname + ' ' + xlsext + ' ' + @xls + ' ' + amount + '); I really need help. It would be greatly appreciated. Thanks in advance.

Jorge L Fernandez · Answer

Hi Khalid Can you put here the exact path that is giving you problem as well as the exact error you got when inserting? Probably your path contains a single quote ' that is causing problem when building your Insert sql. This is well known as SQL Injection so if this is the problem I encourage you to validate each value before form the Insert and avoid some bigger problems.

Khalid · Answer

Thanks a lot Jorge. I really appreciate your help. Actually the problem that I figured out was with the datatype nvarchar(max). I don't know why but when I changed this to nvarchar(100) it worked just fine. Thanks again for your help anyway. Really appreciate it.