System.Data.SqlClient.SqlException: 'Incorrect syntax near 'Text:'.'

Question

I am trying to store an image into a SQL Server database. I keep getting the error around cmd.ExecuteNonQuery().

string fileName = ofd.FileName;

SqlConnection cnn = new SqlConnection();
cnn.ConnectionString = @"Server = Big-PAPI-PC\SQLEXPRESS; Database = LOGO; Trusted_Connection = True";

cnn.Open();

// inserts image and name
string prompt_id = txt_result.ToString();
Image image = pictureBox1.Image;

string query = $"INSERT INTO dbo.LOGO (Logo_Prompt,image) VALUES({ prompt_id} , {image})";

SqlCommand cmd = new SqlCommand(query, cnn);
cmd.ExecuteNonQuery();

// Insertservice(prompt_id,image);
MessageBox.Show("Item inserted  !");
cnn.Close();

Answer 1

You should parameterize your queries:

string query = "INSERT INTO dbo.LOGO (Logo_Prompt,image) VALUES(@prompt_id, @image)";
SqlCommand cmd = new SqlCommand(query, cnn);
cmd.Parameters.AddWithValue("@prompt_id", prompt_id);
cmd.Parameters.AddWithValue("@image", image);

And as @marc_s suggests better pass parameters with explicit db type:

command.Parameters.Add("@prompt_id", SqlDbType.....).Value = prompt_id;
command.Parameters.Add("@image", SqlDbType.....).Value = image;