Hi,
I am new to programming and this forum as well. I am actually working on a windows application with C#. I have encountered a problem which I am not able to solve even after googling for 2 days. It might be a simple thing for all you experts.
I am trying to save the filepath in to the sql server table column. I have made this column of datatype nvarchar(max). This filepath is picked up by the openfiledialog object and then I have put it in a textbox. The insert query I am using in my data access layer is working just fine with other modules however this filepath is creating an error. Even if I assign the whole path to a string variable and pass that variable in to the query it still doesn't work. Here is my query string sqlquery = "INSERT INTO [Costing] ([Date], [xlsdirectory], [xlsname], [xlsext], [xls], [Amount]) VALUES ('" + date + "', '" + xlsdir + "', '" + xlsname + "', '" + xlsext + "' '" + @xls + "', '" + amount + "')";
I really need help. It would be greatly appreciated. Thanks in advance.
Loading
Jorge L FernandezPosted Nov 6, 2009, 7:38 PM
Can you put here the exact path that is giving you problem as well as the exact error you got when inserting? Probably your path contains a single quote ' that is causing problem when building your Insert sql. This is well known as SQL Injection so if this is the problem I encourage you to validate each value before form the Insert and avoid some bigger problems.
KhalidPosted Nov 8, 2009, 6:24 AM
I really appreciate your help. Actually the problem that I figured out was with the datatype nvarchar(max). I don't know why but when I changed this to nvarchar(100) it worked just fine.
Thanks again for your help anyway. Really appreciate it.