Petapoco and parameters

Question

Is there a way to use parameters for Insert queries? I get the following error when I try.

    /// <summary>
    /// Set active survey
    /// </summary>
    public int SetSurveyActive(int brandId, int surveyId)
    {
        Sql sql = new Sql()
            .Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId")
            .Append("VALUES(@0,@1)",brandId,surveyId);

        var result = database.Execute(sql);

        return Convert.ToInt32(result);
    }

enter image description here

wow that seems to be a place of sql injection. – Daniel A. White Dec 06 '12 at 19:19 — Daniel A. White, Dec 06 '12 at 19:19
that's why I'm using parameters :) – chobo Dec 06 '12 at 19:23 — chobo, Dec 06 '12 at 19:23

score 5 · Accepted Answer · answered Dec 06 '12 at 19:22

5

You are missing a bracket:

.Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId")

should be

.Append("INSERT INTO CF.ActiveSurvey(BrandId, SurveyId)")

answered Dec 06 '12 at 19:22

Blorgbeard

101,031
48
228
272

Petapoco and parameters

1 Answers1