Insert Gridview checkbox values in SQL Database

Question

User-2141044294 posted

I am getting error :

Incorrect syntax near the keyword 'select'.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near the keyword 'select'."

This is my code:-

I am getting error :

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;
using System.Configuration;

public partial class SelectStudents : System.Web.UI.Page
{
    String qry;
    SqlConnection con;
    DataTable dt;
    string rname = "";
    string raddress = "";
    string rphone = "";
    string remail = "";
    string r10th = "";
    string r12th = "";
    string rdegree = "";
    string rgraduation = "";
    string rcgpa = "";
    string rresume = "";
    string rcompany = "";
    string select = "";

    protected void Page_Load(object sender, EventArgs e)
    {
        con = new SqlConnection(@"Data Source=(LocalDB)\v11.0;AttachDbFilename=D:\visual projects\ProjectNew\App_Data\Database.mdf;Integrated Security=True");
        con.Open();

    }
    protected void Button1_Click(object sender, EventArgs e)
    {
        foreach (GridViewRow row in GridView1.Rows)
        {
            CheckBox mychkbx = row.FindControl("CheckBox1") as CheckBox;

            if (mychkbx.Checked == true)
            {
                string present = "1";
                string insrt = "insert into StudSelect(rname, raddress, rphone, remail, r10th, r12th, rdegree, rgraduation, rcgpa, rresume, rcompany, select) values('" + rname + "', '"+ raddress +"', '"+rphone+"', '"+remail+"', '"+r10th+"', '"+ r12th +"', '"+rdegree+"', '"+ rgraduation +"', '"+ rcgpa +"', '"+ rresume +"', '"+ rcompany +"', '"+present+"') ";
                
                SqlCommand cmd = new SqlCommand(insrt, con);
                cmd.ExecuteNonQuery();
            }

            else
            {
                string Absent = "0";
                string insrt = "insert into StudSelect(rname, raddress, rphone, remail, r10th, r12th, rdegree, rgraduation, rcgpa, rresume, rcompany, select) values('" + rname + "', '" + raddress + "', '" + rphone + "', '" + remail + "', '" + r10th + "', '" + r12th + "', '" + rdegree + "', '" + rgraduation + "', '" + rcgpa + "', '" + rresume + "', '" + rcompany + "','"+Absent+"') ";

                SqlCommand cmd = new SqlCommand(insrt, con);
                cmd.ExecuteNonQuery();
            }
        }
        con.Close();
    }
    
    protected void GridView1_RowDataBound(object sender, GridViewRowEventArgs e)
    {
        if (e.Row.RowType == DataControlRowType.DataRow)
        {
            string strValue = e.Row.Cells[0].Text;
        }
    }
    protected void GridView1_SelectedIndexChanged(object sender, EventArgs e)
    {

    }
}

Answer 1

User475983607 posted

"Select" is a SQL key word and requires square brackets.

insert into StudSelect(rname, 
        raddress, 
        rphone, 
        remail, 
        r10th, 
        r12th, 
        rdegree, 
        rgraduation, 
        rcgpa, 
        rresume, 
        rcompany, 
        [select]) 

Also, the SQL script is open to SQL injection.  The recommendation is using a parameter query.

https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/ado-net-code-examples#sqlclient

https://stackoverflow.com/questions/31420045/how-to-give-ado-net-parameters/52121416

Answer 2

User503812343 posted

there should be space before select- look for the query changed below

for more info check access sql server from dot net core application

 string insrt = "insert into Stud Select(rname, raddress, rphone, remail, r10th, r12th, rdegree, rgraduation, rcgpa, rresume, rcompany, select) values('" + rname + "', '"+ raddress +"', '"+rphone+"', '"+remail+"', '"+r10th+"', '"+ r12th +"', '"+rdegree+"', '"+ rgraduation +"', '"+ rcgpa +"', '"+ rresume +"', '"+ rcompany +"', '"+present+"') ";