[guycheap]

Hey Guys,

So I'm creating a small application that I could use some help with. I want my C# app to connect to a database and then run a command with the values that a user enters. Look at the below example:


A guys name is John Smith and he's 35. In the application I've set let's say string name=namebox.text or whatever as well as done the same for age. How would I run a create command on mysql or update a mysql command using the variables?

Like so:

INSERT INTO mydb (name, age) VALUES(name, age);

Or

Select * from mydb (name,age) where age = "age";

By "age" I of course mean the user inputted age, The problem is mysql requires the "" around the value and vb will attempt to recognize it as a literal text command. Any help is appreciated. Thanks!

[HighARc]

You could just use simple string concatenation.
I.E.

Code

string query = "INSERT INTO mydb (name, age) VALUES('" +name + "'," + age + "");

or

Code

string query = "Select * from mydb (name,age) where age = " + age + "";

Then you would just use the query for the sql command.

Take note of the single quotes around the variables. Here I assumed that age is an integer field in the database.

Hope this helps ✌

[guycheap]

You could just use simple string concatenation.
I.E.

Code

string query = "INSERT INTO mydb (name, age) VALUES('" +name + "'," + age + "");

or

Code

string query = "Select * from mydb (name,age) where age = " + age + "";

Then you would just use the query for the sql command.

Take note of the single quotes around the variables. Here I assumed that age is an integer field in the database.

Hope this helps ✌

That looks great, thanks so much man!

[Assault]

You could just use simple string concatenation.

Code

string query = "INSERT INTO mydb (name, age) VALUES('" +name + "'," + age + "");

... and you could use string.Format

Code

var query = string.Format("INSERT INTO mydb(name, age) VALUES ('{0}', {1})", name, age);

[phrootoo]

Or, even better, you could all stop being stupid and suggest named parameters. Named parameters mean that you're never at fault for SQL injection, and it also makes your code look mighty cleaner. eg.

SqlCommand command = new SqlCommand("INSERT INTO mydb (name, age) VALUES (@name, @age);");

command.Parameters.AddWithValue("@name", "somenamehere");
command.Parameters.AddWithValue("@age", "someagehere");