SQL parameters not working

Question

This is the code I'm working with right now, I don't get any errors so I can't pinpoint where it's not working:

private void btnAdd_Click(object sender, EventArgs e)
{
    string constring = $"Data Source=(LocalDB)\\MSSQLLocalDB;AttachDbFilename=" +
                       Directory.GetCurrentDirectory().ToString() + "\\BarcodeDB.mdf;Integrated Security=True";
    string query =
       "INSERT INTO Products (Barcodes, Name, EDate, Quantity, Price) VALUES (@barcodeValue, @nameValue, @dateValue, @quantityValue, @priceValue) ;";
    SqlConnection conDataBase = new SqlConnection(constring);
    conDataBase.Open();
    using (var cmd = new SqlCommand(query, conDataBase))        
    {
        cmd.Parameters.AddWithValue("@barcodeValue", tbxBar.Text);
        cmd.Parameters.AddWithValue("@nameValue", tbxName.Text);
        cmd.Parameters.AddWithValue("@dateValue", dateDate.Value.Date);
        cmd.Parameters.AddWithValue("@quantityeValue", tbxQua.Text);
        cmd.Parameters.AddWithValue("@priceValue", tbxPrice.Text);
    }   
    conDataBase.Close();
}

The code might just be wrongly build or I could be missing some part I'm not sure.

I figured out what was not working, was the connection string. So opening a new question for that.

What i had to do is to open the connection and then execute the command

Parameterized queries minimizes SQL injection when `cmd.ExecuteNonQuery()` executes - the injection often occurs when using concatenated values in a query string. What exactly you've tried to do? — Tetsuya Yamamoto, Oct 19 '17 at 07:24
like @BugFinder suggested your code doesnt run the command which is why you get no errors becuase it doesnt actually do anything to return an error — WhatsThePoint, Oct 19 '17 at 07:26
@BugFinder And how do i use that, would be nice if you could help me — LooChar, Oct 19 '17 at 07:26
@TetsuyaYamamoto i havn't tried to much i just added the parameters and since i never get an error i can't se where it's going wrong, but as others are saying i'm not executing the command so might be that — LooChar, Oct 19 '17 at 07:28

score 1 · Accepted Answer · answered Oct 19 '17 at 07:28

1

You're not actually running the command. You need to call ExecuteNonQuery or ExecuteScalar:

using (var cmd = new SqlCommand(query, conDataBase))        
{
    // set parameters...

    cmd.ExecuteNonQuery();
}

answered Oct 19 '17 at 07:28

jeroenh

26,362
10
73
104

i added this and i said i had to open the connection so i did and now it runs without doing anything added the new code to question – LooChar Oct 19 '17 at 07:33

SQL parameters not working

1 Answers1