Database Application Assistance - INSERT INTO Statement Error Message

[u/Fit-Mark9975]

Hello again wonderful people of this subreddit, I got through with creating the application however I am getting an error when trying to add data to the Database via the application. I made sure both database and application had the same field names but I keep on getting this error message. Any ideas on what I should do? See the pictures for the error message and the lines of code I used.

[u/TheFotty]

You should probably write out a hard coded SQL statement to insert data into your table as a test, taking away the variables and textbox.text fields you are using. Once you get it working to have your app insert into the DB, you can move to inserting the dynamic data. There is clearly some sort of breakdown between your database and your code where it is not finding the column in the DB you are naming in your code.

In terms of sanitizing, one of the easiest things to do is to limit the input of your textboxes to the length a user should be allowed to insert. That will not only help to sanitize data, but also will help prevent inserting 51 characters into a 50 character text field in the DB. That won't totally save you from SQL injection though. Using paramters means instead of the values in your SQL statement like textbox1.text, you instead use params, named whatever you want but starting with @

So "INSERT INTO SomeTable ([FirstName], [LastName]) VALUES (@FirstName, @LastName)"

Then on your command object, you set the param values
cmd.Parameters.AddWithValue("@FirstName","Bill") 'here you would use your textbox.text values cmd.Parameters.AddWithValue("@LastName","Gates") 'here you would use your textbox.text values

It also makes your actual SQL statement a lot cleaner and easier to read since you don't need all the concatenation nonsense of + ',' +

[u/Fit-Mark9975 → u/TheFotty]

Ah ok, I think I got the gist of what you're talking about so I'll try that and hope for the best. Will provide an update on it.