While inserting data, I am encountring following error:
MySql.Data.MySqlClient.MySqlException: 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1'\
ignore the SQL injection part for now.
Any help would be much appreciated!!!
private void SaveData(string s)
{
string company = comboBox1.Text.ToString();
int companyid = Convert.ToInt32(comboBox1.SelectedValue);
string vendor = comboBox2.Text.ToString();
int vendorid = Convert.ToInt32(comboBox2.SelectedValue);
string POID = textBox3.Text.ToString();
string expected_date = dateTimePicker2.Value.ToShortDateString();
string todaydate = DateTime.Now.ToString();
string itemPaymentNote = comboBox3.Text.ToString();
try
{
MySqlConnection con = new MySqlConnection(ConfigurationManager.AppSettings["RL_InventoryConnection"]);
if (con.State == ConnectionState.Closed)
con.Open();
MySqlCommand cmd = new MySqlCommand("select * from vendormaster where vendor_id= +'" + vendorid + "' ;", con);
MySqlDataReader dr1 = cmd.ExecuteReader();
string VcontName1="", Vcontphone1 = "", Vcontemail1 = "", VcontName2 = "", Vcontphone2 = "" , Vcontemail2 = "";
while (dr1.Read())
{
VcontName1 = dr1["vendor_contact_Name1"].ToString();
Vcontphone1 = dr1["vendor_contact_phone1"].ToString();
Vcontemail1 = dr1["vendor_contact_email1"].ToString();
VcontName2 = dr1["vendor_contact_Name2"].ToString();
Vcontphone2 = dr1["vendor_contact_phone2"].ToString();
Vcontemail2 = dr1["vendor_contact_email2"].ToString();
}
dr1.Close();
foreach (DataGridViewRow dr in dataGridView1.Rows)
{
var ItemTypeCell = dr.Cells[0].Value;
var ItemNameCell = dr.Cells[1].Value;
var ItemModelCell = dr.Cells[2].Value;
var DescriptionCell = dr.Cells[3].Value;
var QuantityCell = dr.Cells[4].Value;
var UnitPriceCell = dr.Cells[5].Value;
var OtherNotesCell = dr.Cells[6].Value;
var GSTCell = dr.Cells[7].Value;
var CGSTCell = dr.Cells[8].Value;
var SGSTCell = dr.Cells[9].Value;
var ItemTotalCell = dr.Cells[10].Value;
Console.WriteLine(s);
string a = "N/A";
//MySqlCommand cmd1 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "', '" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "', +'" + a + "' ;", con);
MySqlCommand cmd1 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "','" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "' , +'" + a + "' ;", con);
cmd1.ExecuteNonQuery();
}
}
catch (Exception ex)
{
throw ex;
}
}
Sameer FarooquiPosted Sep 4, 2022, 9:32 PM
cmd4 is having issue. I checked my data types and everything looks good. I added comment in cmd 4, the first comment is data type C# holds and second comment shows data type mysql holds:
updated code here:
private void SaveData(string s)
{
var company = comboBox1.Text.ToString();
int companyid = Convert.ToInt32(comboBox1.SelectedValue);
var vendor = comboBox2.Text.ToString();
int vendorid = Convert.ToInt32(comboBox2.SelectedValue);
var POID = textBox3.Text.ToString();
var expected_date = dateTimePicker2.Value.ToShortDateString();
var todaydate = DateTime.Today;
var itemPaymentNote = comboBox3.Text.ToString();
try
{
MySqlConnection con = new MySqlConnection(ConfigurationManager.AppSettings["RL_InventoryConnection"]);
if (con.State == ConnectionState.Closed)
con.Open();
MySqlCommand cmd = new MySqlCommand("select * from vendormaster where vendor_id= +'" + vendorid + "' ;", con);
MySqlDataReader dr1 = cmd.ExecuteReader();
string VcontName1="", Vcontphone1 = "", Vcontemail1 = "", VcontName2 = "", Vcontphone2 = "" , Vcontemail2 = "";
while (dr1.Read())
{
VcontName1 = dr1["vendor_contact_Name1"].ToString();
Vcontphone1 = dr1["vendor_contact_phone1"].ToString();
Vcontemail1 = dr1["vendor_contact_email1"].ToString();
VcontName2 = dr1["vendor_contact_Name2"].ToString();
Vcontphone2 = dr1["vendor_contact_phone2"].ToString();
Vcontemail2 = dr1["vendor_contact_email2"].ToString();
}
dr1.Close();
foreach (DataGridViewRow dr in dataGridView1.Rows)
{
var ItemTypeCell = dr.Cells[0].Value;
var ItemNameCell = dr.Cells[1].Value;
var ItemModelCell = dr.Cells[2].Value;
var DescriptionCell = dr.Cells[3].Value;
int QuantityCell = Convert.ToInt32( dr.Cells[4].Value);
double UnitPriceCell = Convert.ToDouble( dr.Cells[5].Value);
var OtherNotesCell = dr.Cells[6].Value;
var GSTCell = dr.Cells[7].Value;
var CGSTCell = dr.Cells[8].Value;
var SGSTCell = dr.Cells[9].Value;
double ItemTotalCell =Convert.ToDouble( dr.Cells[10].Value);
Console.WriteLine(s);
//var a = "N/A";
MySqlCommand cmd1 = new MySqlCommand("select * from categorymaster where category_name like '" + ItemTypeCell + "' ;", con);
MySqlDataReader dr2 = cmd1.ExecuteReader();
int ItemTypeCellValue=0;
while (dr2.Read())
{
ItemTypeCellValue = Convert.ToInt32(dr2["Cat_ID"]);
}
dr2.Close();
MySqlCommand cmd2 = new MySqlCommand("select bm.Brand_id, bm.Cat_id_fk, bm.Brand_name from brandmaster bm join categorymaster cm on cm.Cat_id =bm.Cat_id_fk where cm.Cat_id = " + ItemTypeCellValue + " and bm.Brand_name like '" + ItemNameCell + "' ;", con);
MySqlDataReader dr3= cmd2.ExecuteReader();
int ItemNameCellValue = 0;
while (dr3.Read())
{
ItemNameCellValue = Convert.ToInt32(dr3["Brand_id"]);
}
dr3.Close();
MySqlCommand cmd3 = new MySqlCommand("select mm.Model_name, mm.Model_id, mm.Brand_id_fk from modelmaster mm join brandmaster bm on bm.Brand_id = mm.Brand_id_fk join categorymaster cm on cm.Cat_ID = bm.Cat_id_fk where cm.Cat_id ='" + ItemTypeCellValue + "' and bm.Brand_id = '" + ItemNameCellValue + "' and mm.Model_name like '" + ItemModelCell + "';", con);
MySqlDataReader dr4 = cmd3.ExecuteReader();
int ItemModelCellValue = 0;
while (dr4.Read())
{
ItemModelCellValue = Convert.ToInt32(dr4["Model_id"]);
}
Console.WriteLine(ItemModelCellValue);
dr4.Close();
//MySqlCommand cmd1 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(+'" + POID + "', +'" + vendorid + "', 1, SYSDATE(), '" + companyid + "', '" + s + "', +'" + QuantityCell + "', '" + UnitPriceCell + "', '" + GSTCell + "', '" + CGSTCell + "','" + SGSTCell + "', '" + ItemTotalCell + "', '" + itemPaymentNote + "', '" + OtherNotesCell + "', '" + VcontName1 + "', '" + Vcontphone1 + "','" + Vcontemail1 + "', '" + VcontName2 + "', '" + Vcontphone2 + "', '" + Vcontemail2 + "', '" + expected_date + "', +'" + a + "' ;", con);
MySqlCommand cmd4 = new MySqlCommand("insert into pomaster ( po_id,vendor_id_fk,user_id_fk,po_date,comp_id_fk,Cat_ID_FK,Brand_id_fk,Model_id_fk, po_status,quantity,cost_per_unit,gst_percent,CGST, SGST,total_amount,payment_notes,other_notes,Vendor_Contact_name,Vendor_Contact_phone1,Vendor_Contact_email1,Vendor_Contact_person2,Vendor_Contact_phone2,Vendor_Contact_email2,expected_delivery_date,actual_delivery_date) values(@poid, @vendorid, @userid, @sysdate, @companyid,@itemtype ,@itemname ,@itemmodel, @postatus, @quantity, @unitprice, @GST,@CGSTCell,@SGSTCell, @ItemTotalCell, @itemPaymentNote, @OtherNotesCell, @VcontName1, @Vcontphone1,Vcontemail1, @VcontName2, @Vcontphone2, @Vcontemail2, @expected_date , @actual_delivery_date ", con);
cmd4.Parameters.AddWithValue("@poid", POID);// string // varchar
cmd4.Parameters.AddWithValue("@vendorid", vendorid);//int // int
cmd4.Parameters.AddWithValue("@userid", 1);//int // varchar
cmd4.Parameters.AddWithValue("@sysdate", todaydate) ;// date //date
cmd4.Parameters.AddWithValue("@companyid", companyid); // int // bigint
cmd4.Parameters.AddWithValue("@itemtype", ItemTypeCellValue); // int // int
cmd4.Parameters.AddWithValue("@itemname", ItemNameCellValue); // int // int
cmd4.Parameters.AddWithValue("@itemmodel", ItemModelCellValue); // int // int
cmd4.Parameters.AddWithValue("@postatus", s); // string // varchar
cmd4.Parameters.AddWithValue("@quantity", QuantityCell);//int // int
cmd4.Parameters.AddWithValue("@unitprice", UnitPriceCell);//double //double
cmd4.Parameters.AddWithValue("@GST", GSTCell); // string // varchar
cmd4.Parameters.AddWithValue("@CGSTCell", CGSTCell); // string // varchar
cmd4.Parameters.AddWithValue("@SGSTCell", SGSTCell); // string // varchar
cmd4.Parameters.AddWithValue("@ItemTotalCell", ItemTotalCell); // double //double
cmd4.Parameters.AddWithValue("@itemPaymentNote", itemPaymentNote);// string // varchar
cmd4.Parameters.AddWithValue("@OtherNotesCell", OtherNotesCell); // string // varchar
cmd4.Parameters.AddWithValue("@VcontName1", VcontName1); //string //varchar
cmd4.Parameters.AddWithValue("@Vcontphone1", Vcontphone1);//string //varchar
cmd4.Parameters.AddWithValue("@Vcontemail1", Vcontemail1);//string //varchar
cmd4.Parameters.AddWithValue("@VcontName2", VcontName2);//string //varchar
cmd4.Parameters.AddWithValue("@Vcontphone2", Vcontphone2);//string //varchar
cmd4.Parameters.AddWithValue("@Vcontemail2", Vcontemail2);//string //varchar
cmd4.Parameters.AddWithValue("@expected_date", expected_date); //date // date
cmd4.Parameters.AddWithValue("@actual_delivery_date", null); //date //date
cmd4.ExecuteNonQuery();
}
}
catch (Exception ex)
{
throw ex;
}
}
Sachin SinghPosted Sep 3, 2022, 5:38 PM
Sameer FarooquiPosted Sep 3, 2022, 4:19 PM
Sameer FarooquiPosted Sep 3, 2022, 12:45 PM
Abhishek ChadhaPosted Sep 3, 2022, 12:43 PM
Sameer FarooquiPosted Sep 3, 2022, 12:41 PM
Sameer FarooquiPosted Sep 3, 2022, 12:37 PM
yes, the proper data is populating for these two variables. Attached the screenshot for the same.

Abhishek ChadhaPosted Sep 3, 2022, 12:24 PM
Sameer FarooquiPosted Sep 3, 2022, 12:17 PM
Abhishek ChadhaPosted Sep 3, 2022, 12:11 PM