SQL Insert into statement

Question

strSQL = "INSERT INTO Accounts UserName, Password VALUES ('" & txtUsername.Text & "', '" & txtEncryptedPassword & "');"

When the code is executed and error is thrown, but there is no visible problem that i can see. Help!

It helps if you include the error you are getting in your question. — T I
– T I, Commented Mar 21, 2014 at 12:25
You need to put the column list in paranthesis ... INTO Accounts (UserName, Password) ... — T I
– T I, Commented Mar 21, 2014 at 12:26
@Callum, look at my update1... the test mean add your database name.. — jmail
– jmail, Commented Mar 21, 2014 at 12:51

Community · Accepted Answer · 2017-05-23 12:28:48Z

The word PASSWORD is reserved in MS-Access.
You need to use square brackets around that name (Or change it to something different)

strSQL = "INSERT INTO Accounts (UserName, [Password]) VALUES (......

Said that, please use a parameterized query to build sql commands.
A string concatenation like yours is easily attacked by hackers using SQL Injection
Also, if the username or password contains a single quote, the resulting sql text built using string concatenation will be invalid.

strSQL = "INSERT INTO Accounts (UserName, [Password]) VALUES (?, ?)" OleDbCommand cmd = new OleDbCommand(strSQL, connection); cmd.Parameters.AddWithValue("@p1",txtUsername.Text); cmd.Parameters.AddWithValue("@p2",txtEncryptedPassword); cmd.ExecuteNonQuery();

Thanks the reserved word was the problem, hackers aren't really an issue it is only for a college project.

Alexander · Accepted Answer · 2014-03-21 12:26:22Z

1

You forgot parentheses:

strSQL = "INSERT INTO Accounts (UserName, Password) VALUES ('" & txtUsername.Text & "', '" & txtEncryptedPassword & "');"

answered Mar 21, 2014 at 12:26

Alexander

3,1992 gold badges21 silver badges34 bronze badges

1 Comment

Callum Hutchinson Over a year ago

OleDbException was unhandled . Syntax error in INSERT INTO statement

jmail · Accepted Answer · 2014-03-21 12:42:56Z

try this code:

 Dim strSQL As String = "INSERT INTO tblDetail VALUES('" & strPersonCode _ & "','" & strForename & "','" & strSurname & "','" & strDateOfBirth & "'," & strCurrentlyWith & ",'" & strConditions & "')"

Do it like that but change to your names. Declare the values of text boxes as strings and just use those.

jmail · Accepted Answer · 2014-03-21 13:16:59Z

your doing () this mistake and you should must add:

your code:

strSQL = "INSERT INTO Accounts UserName, Password VALUES ('" & txtUsername.Text & "', '" & txtEncryptedPassword & "');"

you should must change code following as:

strSQL = "INSERT INTO Accounts (UserName, Password) VALUES ('" & txtUsername.Text & "', '" & txtEncryptedPassword & "');"

update1:

"INSERT INTO `test`.`users` ( `username`, `password`) " & _ "VALUES ('" & txtUsername.Text & "', '" & txtPassword.Text & "');"

update2:

 "INSERT INTO users ( `username`,`password`)VALUES(@txtUsername.Text,@txtPassword.Text);"

"INSERT INTO users (Username,Password)VALUES(?,?);"

note:test means database name you should change your databasename.

Collectives™ on Stack Overflow

SQL Insert into statement

4 Answers 4

1 Comment

1 Comment

Comments

3 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

1 Comment

1 Comment

Comments

3 Comments

Linked

Related