-3

i am having this error when running my application:

The name "DHR32S" is not permitted in this context. Valid expressions are constants, constant expressions, and (in some contexts) variables. Column names are not permitted.

here is my code:

c2.command("insert into haraki_item values(" + iddd + ",'Selling Facture','" + itemid + "','" + name + "'," + lasttotal + "," + balancee + ",'" + date + "')");

"DHR32S" is the itemid

Roman Koliada
  • 4,286
  • 2
  • 30
  • 59
Hadi Kassem
  • 11
  • 1
  • 7
    chances are your item contains something you dont expect such as a number with a comma in? this is why you should use parameters - let alone the whole sql injection reasons – BugFinder Nov 29 '17 at 09:27
  • 1
    Possible duplicate of [What are good ways to prevent SQL injection?](https://stackoverflow.com/questions/14376473/what-are-good-ways-to-prevent-sql-injection) – mjwills Nov 29 '17 at 09:34

1 Answers1

1

You SHOULD always use parameters, for lot of reasons. Here you are missing quotes around concatenated values.

 values(" + iddd + ", //<--you are missing quotes around idd

Try with parameters:

c2.command("insert into haraki_item values(@iddd ,@SellingFacture,@itemid ...
command.Parameters.AddWithValue(@iddd,iddd);
command.Parameters.AddWithValue(@SellingFacture,SellingFacture);
....
mjwills
  • 23,389
  • 6
  • 40
  • 63
apomene
  • 14,282
  • 9
  • 46
  • 72