Error when input data to MySQL via VB.Net Application

Asked Jan 07 '15 at 14:09

Active Jan 13 '15 at 16:45

Viewed 54 times

I have a project that input data to MySQL via vb.net application.

But, when I want to input the data, I got an error like this :

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''',,'',,'',',)' at line 1

This is my code :

Private Sub Insertbtn_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Insertbtn.Click
    Dim Query As String
    'Query = "INSERT INTO  userreg"
    Dim con As MySqlConnection = New MySqlConnection("Data Source=localhost;Database=test;User ID=root;Password=;")
    'Dim sql As MySqlCommand = New MySqlCommand(Query, con)

    Query = "INSERT INTO tbl_data_pegawai(nip, nama_pegawai, tempat_lahir, tanggal_lahir, jenis_kelamin, usia, status_pegawai, tanggal_pengangkatan_cpns, alamat)VALUES("
    Query = Query + TextBox1.Text + ",'" + TextBox2.Text + "'," + TextBox3.Text + ",'" + TextBox4.Text + "'," + TextBox5.Text + TextBox6.Text + ",'" + TextBox7.Text + "'," + TextBox8.Text + "'," + TextBox9.Text + ")"
    con.Open()

    Dim cmd As MySqlCommand = New MySqlCommand(Query, con)

    Dim i As Integer = cmd.ExecuteNonQuery()
    If i > 0 Then
        lblMsg.Text = "Success"
    Else
        lblMsg.Text = "Not Success"
    End If
    con.Close()
End Sub

edited Jan 13 '15 at 16:45

Carl Onager

4,112
2
38
66

asked Jan 07 '15 at 14:09

user3169200

Don't build sql commands using data directly from the user. Use parameterized queries. – Lynn Crumbling Jan 07 '15 at 14:12
how to use parameterize queries ? – user3169200 Jan 07 '15 at 14:13
To join string in VB.NET use `&` – Avijit Jan 07 '15 at 14:13
See http://stackoverflow.com/q/542510/656243. – Lynn Crumbling Jan 07 '15 at 14:14
Avijit : can you give an example ? – user3169200 Jan 07 '15 at 14:15
See http://stackoverflow.com/questions/734600/the-difference-between-and-for-joining-strings-in-vb-net – Avijit Jan 07 '15 at 14:18
@user3169200 You no longer need to be doing any concatenation once you switch to parameterized queries. – Lynn Crumbling Jan 07 '15 at 14:21
Also see how to parameterise http://stackoverflow.com/questions/13580993/c-sharp-mysqlcommand-command-parameters-add-is-obsolete – Avijit Jan 07 '15 at 14:22
Always use `command.Parameters.AddWithValue("@mcUserName", mcUserNameNew);` to pass parameters to minimize sql injection/security issues. – Avijit Jan 07 '15 at 14:25
here `TextBox5.Text + TextBox6.Text + ` and also here `"'," + TextBox8.Text + "'," ` However drop this mess immediately and use parameters ALWAYS – Steve Jan 07 '15 at 14:57
Thanks all, the problem already resolved. – user3169200 Jan 07 '15 at 15:47

Error when input data to MySQL via VB.Net Application

0 Answers0