Syntax error in INSERT INTO command on Visual Studio

Question

I have an easy insert query, but visual studio return "Syntax error in INSERT INTO command", i copy+paste the exact same query in the db (access) and it work... Any help??

 public void Create(string mail, string nickname, string password, string avatar)
    {
        OleDbConnection cn = new OleDbConnection(_connectionString);
        OleDbCommand cmd = new OleDbCommand();
        try
        {

            String PwdSHA256;
            SHA256 mySHA256 = SHA256.Create();
            byte[] hashValue = mySHA256.ComputeHash(Encoding.UTF8.GetBytes(password));
            StringBuilder builder = new StringBuilder();
            for (int i = 0; i < hashValue.Length; i++)
            {
                builder.Append(hashValue[i].ToString("x2"));
            }
            PwdSHA256 = builder.ToString();

            cn.Open();
            cmd.Connection = cn;
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "INSERT INTO utenti ([email],[nickname],[password],[avatar],[attivo]) " +
                "VALUES ('" + mail + "', '" + nickname + "', '" + PwdSHA256 + "','', false)";

            cmd.ExecuteNonQuery();
        }
        catch (Exception ex)
        {
            System.Web.HttpContext.Current.Session["errore"] = ex;
            System.Web.HttpContext.Current.Response.Redirect("ErrorPage.aspx");
            this._errore = ex.Message;
        }
        finally
        {
            cmd = null;
            cn.Close();
        }
    }

use **parameterised statements** or enjoy your SQL injection attacks. — Franz Gleichmann, Dec 21 '19 at 12:06
First, `false` is not a boolean in your insert but a string. Second, what @FranzGleichmann says. — VDWWD, Dec 21 '19 at 12:17
Any programmer that works with user data will eventually learn about [Bobby Tables](https://bobby-tables.com/). More [here](https://stackoverflow.com/q/7505808/4003419) — LukStorms, Dec 21 '19 at 12:50

score 0 · Answer 1 · answered Dec 21 '19 at 15:13

Using SQL queries directly in your code is not a good coding practice, use SQL procedures and pass the parameters to SQL.
And be clear, the error you are facing is an execution time error or a compilation.
Use dbo.Your_DB_Name.utenti or Your_DB_Name.utenti instead of utenti.
Wrap up your 'false'
Are you still using PwdSHA256 encryption

score -1 · Answer 2 · answered Dec 21 '19 at 12:20

Maybe you should change

 cmd.CommandText = "INSERT INTO utenti (email,nickname,password,avatar,attivo) " +
            "VALUES ('" + mail + "', '" + nickname + "', '" + PwdSHA256 + "','', false)";

And make sure your column in database is same with your query

Syntax error in INSERT INTO command on Visual Studio

2 Answers2