Error near Where Clause in ASP NET

Question

Below is a code and Visual Studio is raising error that there is syntax error near WHERE.

SqlCommand cmd2 = new SqlCommand("insert into courses(t_id_fk) values('" + valu3 + "') where c_id=@dr1 ", con);
cmd2.CommandType = CommandType.Text;
                cmd2.Parameters.Add("@dr1", SqlDbType.Int);
                cmd2.Parameters["@dr1"].Value = d1;
                cmd2.ExecuteNonQuery();
                con.Close();

Do not concatenate valu3 in like that. It is a **very bad idea**. Have a read of https://stackoverflow.com/questions/4892166/how-does-sqlparameter-prevent-sql-injection . — mjwills, Jun 08 '17 at 09:52

Vijunav Vastivch · Accepted Answer · 2017-06-08T03:06:05.330

4

remove where clause while inserting:

from:

"insert into courses(t_id_fk) values('" + valu3 + "') where c_id=@dr1 "

to:

"insert into courses(t_id_fk) values('" + valu3 + "')"

But if the sample given above is an update then:

 "update courses set t_id_fk = '" + valu3 + "'  where c_id=@dr1"

edited Jun 08 '17 at 03:06

answered Jun 08 '17 at 02:57

Vijunav Vastivch

4,153
1
16
30

1

It is not an update.. It is inserting a record. @AD.Net – Vijunav Vastivch Jun 08 '17 at 02:58
2

sorry my bad, too tired :( – AD.Net Jun 08 '17 at 02:59
1

This is correct. You can't insert using VALUES WHERE a condition is true. The rows you are inserting are the new rows... you can, however, INSERT INTO MyTable SELECT Stuff FROM Crap WHERE Thingy=1; – Robert Columbia Jun 08 '17 at 03:10
1

Agreed @Robert Columbia – Vijunav Vastivch Jun 08 '17 at 03:20

Error near Where Clause in ASP NET

1 Answers1