Insert statement

Question

Hai all..

My goal is to insert an object value into the database if it satisfies certain condition.

How to insert it???

i tried but i can just insert values given in the statement like

"INSERT INTO SourceCount(Source,Count)" + "Values('192.168.11.1','5')";
but wat i want is

object source1 = 192.168.11.1

i want to insert source1 value.....which changes continiously
Hope i made myself clear.........

Bechir Bejaoui · Answer

Of Corse...... You just open Google.... put Sql injection...... and press OK then you're there.....

krishna prasad · Answer

Hai man.... Sorry i am just a begineer...anyway are u referring to SQL injection attack if yes.......explain us with an example how to use parameterized sql objects as reffered by you...may be it could help us a lot.......

Bechir Bejaoui · Answer

cmdsrc.CommandText = INSERT INTO SourceCount(+ SourceCoun t+) Values(+ @Source@Count +); Never do that this resuest could be an object of an SQL injection if you have parametrised request then you have to use either sql parameters or oledb parameters

krishna prasad · Answer

Hai all... Sorry for my late reply....... SqlCommand cmdsrc = con.CreateCommand(); cmdsrc.CommandText = INSERT INTO SourceCount(+SourceCount+) Values(+@Source@Count+); cmdsrc.Parameters.Add(@Source SqlDbType.NVarChar 50); cmdsrc.Parameters.Add(@Count SqlDbType.NVarChar 50); cmdsrc.Parameters[@Source].Value = src1; cmdsrc.Parameters[@Count].Value = count; cmdsrc.ExecuteNonQuery(); This is the small bit of code......Here SourceCount is the table name.... and src1count are the values which i wanted to insert....which changes continously....... This code is running fine........

Bechir Bejaoui · Answer

You have to add a trigger on the update operation so that when a condition is satisfyed then an SQL instruction is executed http://msdn.microsoft.com/en-us/library/ms189799.aspx

Vijaya Kadiyala · Answer

Hi its nice way of saying thank you if you post what changes you made to your code to make it work..so that we can also learn :) Thanks -- Vijaya Kadiyala

Mirko Meier · Answer

@ krishna prasad It would be very nice to post the solution in this thread.

krishna prasad · Answer

Hai all.... Thanks for the reply...i got the solution..many thanks...

Vijaya Kadiyala · Answer

Hi Is it resolved?

Lisa · Answer

what actually is happening when you run that. are you getting any sort of error while running that block of code. Thanks Lisa

Mirko Meier · Answer

Thats right. parameterized Queries are in the first moment more complicated as a Query combined by a string. The advantages of a parameterized Query has a beter security (SQL Injection) and you are not responsible for types which you set as Parameter-Value

Vijaya Kadiyala · Answer

I would suggest first you write one INSERT statement and make sure that is running using any Database Tools. Then put this same statement in code and run this using ADO.NET. Now parameterize this query to make it more generic. Then you will come to know where the problem is. Thanks Vijaya Kadiyala http :// dotnetvj . blogspot . com

Scott Lysle · Answer

You can pass variable to the command text string or you can use parameters instead of a hardcoded value.