Format a SQL statement, introducing my numbered parameters

Question

I have the following query string:

INSERT INTO cibi ([nome], [Zuccheri_100g], [tipo], [Nome_EN], [Nome_DE],[Nome_ES], [DefaultAmt])
VALUES ('{1}', {2}, {3}, '{4}', '{5}', '{6}', {7})

Now I have a list of strings called values that I want to replace into the numbers. What is the code I should use? Should I use replace?

Thanks

Answer 1

As suggested by marc and JNevill, use sql parameters when composing your query string. I assume your values variable is always a 7-element array of strings

using System.Data;
using System.Data.SqlClient;

DataTable myDataTable = new DataTable();

using (SqlConnection sqlConnection = new SqlConnection(.....)
{
    using (SqlCommand sqlCommand = new SqlCommand())
    {
        sqlCommand.Connection = sqlConnection;
        sqlCommand.CommandType = CommandType.Text;

        sqlCommand.Parameters.AddWithValue("@V0", values[0]);
        sqlCommand.Parameters.AddWithValue("@V1", values[1]);
        sqlCommand.Parameters.AddWithValue("@V2", values[2]);
        sqlCommand.Parameters.AddWithValue("@V3", values[3);
        sqlCommand.Parameters.AddWithValue("@V4", values[4]);
        sqlCommand.Parameters.AddWithValue("@V5", values[5]);
        sqlCommand.Parameters.AddWithValue("@V6", values[6]);

        string queryStr = "INSERT INTO cibi ([nome], [Zuccheri_100g], [tipo], [Nome_EN], [Nome_DE],[Nome_ES], [DefaultAmt]) VALUES (@V0, @V1, @V2, @V3, @V4, @V5, @V6)";

        sqlCommand.CommandText = queryStr;
        sqlConnection.Open();
        SqlDataReader sqlDataReader = sqlCommand.ExecuteReader();
        myDataTable.Load(sqlDataReader);
        sqlConnection.Close();
    }
}