Incorrect Syntax error when inserting values into SQL database from Windows form

Question

I want to connect a Windows Form app with SQL Server and insert values from the app textboxes to a database. When the button is clicked, I receive an error:

Incorrect syntax near the keyword "Group".

What is the problem? How can I insert this data?

 private void button1_Click(object sender, EventArgs e)
    {

        try
        {
            string myconnection = @"Data Source=(localdb)\MSSQLLocalDB;Initial Catalog=StudBase;Integrated Security=True";
            string Query = "Insert Into StudentInfo (StudentID, Name,Surname,Group,Course,City,Sector,Average rating) values('" +this.textBox1.Text+"','" + this.textBox2.Text + "','" + this.textBox4.Text + "','" + this.textBox6.Text + "','" + this.textBox8.Text + "','" + this.textBox3.Text + "','" + this.textBox5.Text + "','" + this.textBox3.Text + "');";

            SqlConnection Myconn = new SqlConnection(myconnection);
            SqlCommand Mycom = new SqlCommand(Query, Myconn);
            SqlDataReader Reader1;
            Myconn.Open();
            Reader1 = Mycom.ExecuteReader();
            MessageBox.Show("Save data");
            while (Reader1.Read())
            {

            }
            Myconn.Close();
        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.Message);
        }


    }

enter image description here

Use parameters https://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements — SehaxX, Jun 30 '18 at 14:07
Put a square brackets around Group. Group is a reserved name so a syntax error is occurring. — jdweng, Jun 30 '18 at 14:07
If I were your instructor, I'd deduct at least full letter grade for not using a parameterized query. — Dan Guzman, Jun 30 '18 at 14:17
You need to parameterize your query otherwise you'll be opened to sql injection. — RiceRiceBaby, Jun 30 '18 at 14:24
I came expecting to find SQL injectable code and I was not disappointed. Your code will fail if somebody puts a single quote `'` into any textbox. Do as SehaxX says :) — ProgrammingLlama, Jun 30 '18 at 15:09
I assume, by your comment, @KananIbrahimli you mean that the comments about injection helped you write better code? :) — Thom A, Jun 30 '18 at 17:20

score -1 · Answer 1 · answered Jun 30 '18 at 17:58

Use this for your query statement -

string Query = "Insert Into StudentInfo (StudentID,[Name],Surname,[Group],Course,City,Sector,[Average rating]) values('" +this.textBox1.Text+"','" + this.textBox2.Text + "','" + this.textBox4.Text + "','" + this.textBox6.Text + "','" + this.textBox8.Text + "','" + this.textBox3.Text + "','" + this.textBox5.Text + "','" + this.textBox3.Text + "');";

Use [] for reserved keywords in SQL. Also the last column Average rating was not covered with [], as this column name has space then it should be quoted in [].

Incorrect Syntax error when inserting values into SQL database from Windows form

1 Answers1