0

My code as follows:

namespace EntityDAO
{
   public static class StudentDAO
    {
       public static Boolean AddStudent(StudentDTO oDto)
       {
           string str =System.Configuration.ConfigurationManager.AppSettings["myconn"];
           SqlConnection oconnection = new SqlConnection(str);

           oconnection.Open();

           try
           {
               string addstring = "insert into STUDENT(ID,NAME)values('"
               + oDto.ID + "','"
               + oDto.NAME + "')";
               SqlCommand ocommand = new SqlCommand(addstring,oconnection);
               ocommand.ExecuteNonQuery();
               return true;
           }
           catch
           {
               return false;
           }
           finally
           {
               oconnection.Close();
           }

but when I run this program ,an error message has been occured and the error message for oconnection.Open(); and the message is 'InvalidOperationException'(Instance failure).I have tried many times to solve this problem but i did't overcome this problem.so please,anyone help me.

Mohibullah
  • 571
  • 1
  • 4
  • 5
  • Please post your connection string – Zev Spitz Dec 19 '12 at 06:20
  • 2
    The error happens when it `"Cannot open a connection without specifying a data source or server."` or `The connection is already open.` Check which of these is your problem. – Ravi Y Dec 19 '12 at 06:22
  • Dear Zev Spitz ,Did you mean my application configuration code.don't mind,i am newer novice in c#. – Mohibullah Dec 19 '12 at 06:27
  • @MohibUllah What does myconn contain? Please post its contents which would give us an idea of the connection details and we can help identify the error. – Mamta D Dec 19 '12 at 06:27
  • 2
    I am not proposing any solution, but if you are un-aware of SQL injecton, please be now. You are creating dynamic queries, which creates the SQL injection vulnerability in your code. Google it and change code accordingly. – AYK Dec 19 '12 at 06:32
  • 3
    This sounds ultimately like a configuration error in the database server, not a coding error. If the line that is broken is the `.Open()`, then either: the connection string is simply wrong, or the server isn't working. Not sure this can be answered as a programming question. However! Please note everything @AYK says: he is absolutely right. If you commonly right database code like in the question, then frankly your database server not working is probably a *good* thing, as it is saving you from a **massive** security problem. – Marc Gravell Dec 19 '12 at 06:50

1 Answers1

0

The following is not proposed as a complete solution to your problem, but should help you figure it out:

namespace EntityDAO
{
    public static class StudentDAO
    {
        public static Boolean AddStudent(StudentDTO oDto)
        {
            var str = ConfigurationManager.AppSettings["myconn"];
            using (var oconnection = new SqlConnection(str))
            {
                oconnection.Open();

                try
                {
                    var addstring = string.Format(
                        "insert into STUDENT(ID,NAME)values('{0}','{1}')", oDto.ID, oDto.NAME);
                    using (var ocommand = new SqlCommand(addstring, oconnection))
                    {
                        ocommand.ExecuteNonQuery();
                    }
                    return true;
                }
                catch (Exception ex)
                {
                    Debug.WriteLine(ex.ToString());
                    return false;
                }
            }
        }
    }
}

Don't ever hide exceptions from yourself. Even if the caller of this code wants true or false, make sure you log the details of the exception.

Also, what AYK said about SQL Injection. I'm entering this as CW, so if someone has more time than I do, they should feel free to edit to use parameters.

John Saunders
  • 160,644
  • 26
  • 247
  • 397
  • Thanks John Saunders,the code ,that you have given in above, has been worked successfully.Again thanks for your cordiality.best of luck. – Mohibullah Dec 19 '12 at 10:07