I'm creating an application where I store my inputs (name, age, phone) from the textbox and when I click Submit
, it should store whatever I input onto the textbox into the database but I keep getting this error.
An exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll but was not handled in user code. Additional Information: Incorrect syntax near the keyword 'Table'.
Here is the following code:
protected void Button1_Click(object sender, EventArgs e)
{
String p = UniqueNumber();
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings
["ConnectionString"].ConnectionString);
con.Open();
String str = "insert into Table(uniqueno, name, age, number) values( '"
+ Label1.Text + "','" + txtName.Text + "','" + txtAge.Text + "','" + txtNumber.Text + "')";
SqlCommand cmd = new SqlCommand(str, con);
cmd.ExecuteNonQuery();
con.Close();
Session["id"] = Label1.Text;
Session["name"] = txtName.Text;
try
{
Response.Redirect("unique.aspx");
}
catch
{
Label1.Text = "Please enter correct details....";
this.Label1.ForeColor = Color.Red;
}
}
答案 0 :(得分:0)
"Table"
is keyword, although you may have stored data into the Table, I don't think SQL server would allow you to query that.
Surprisingly, it allows us to have a table named Table but when we try to select, it throws an error. And as @seth flower mentioned, try avoiding SQL injection vulnerabilities.