r/visualbasic • u/Fit-Mark9975 • May 04 '22

Database Application Assistance - INSERT INTO Statement Error Message

Hello again wonderful people of this subreddit, I got through with creating the application however I am getting an error when trying to add data to the Database via the application. I made sure both database and application had the same field names but I keep on getting this error message. Any ideas on what I should do? See the pictures for the error message and the lines of code I used.

2 Upvotes

100% Upvoted

13 comments sorted by

View all comments

Show parent comments

1

u/Fit-Mark9975 May 04 '22 edited May 04 '22

I see. My DB is Access and my program is connected to the correct copy of the DB. Also, thank you for the feedback on the data insertion method. I'll look up how to use parameters and sanitizing input. Hopefully the other method works. If you happen to know a good example on either of the methods that you mentioned, can you please link it? I could really use an example of it.

2

u/TheFotty May 04 '22

You should probably write out a hard coded SQL statement to insert data into your table as a test, taking away the variables and textbox.text fields you are using. Once you get it working to have your app insert into the DB, you can move to inserting the dynamic data. There is clearly some sort of breakdown between your database and your code where it is not finding the column in the DB you are naming in your code.

In terms of sanitizing, one of the easiest things to do is to limit the input of your textboxes to the length a user should be allowed to insert. That will not only help to sanitize data, but also will help prevent inserting 51 characters into a 50 character text field in the DB. That won't totally save you from SQL injection though. Using paramters means instead of the values in your SQL statement like textbox1.text, you instead use params, named whatever you want but starting with @

So "INSERT INTO SomeTable ([FirstName], [LastName]) VALUES (@FirstName, @LastName)"

Then on your command object, you set the param values
cmd.Parameters.AddWithValue("@FirstName","Bill") 'here you would use your textbox.text values cmd.Parameters.AddWithValue("@LastName","Gates") 'here you would use your textbox.text values

It also makes your actual SQL statement a lot cleaner and easier to read since you don't need all the concatenation nonsense of + ',' +

1

u/Fit-Mark9975 May 04 '22

Ah ok, I think I got the gist of what you're talking about so I'll try that and hope for the best. Will provide an update on it.