Member Avatar for Mike Bishop

Hi all,

As you will be able to tell i am very new at VB.net. i have the following code that
adds three text fields to my sql table.

it works if i input numbers i.e the number 1 in all three feilds but as soon as i
in input text i get the error

Error while inserting record on table... the name "Mike" is not permitted in this context. valid expressions are constants, contact expressions, and(in come contexts variables. column names are not permitted.

This has nothing to do with the way that the sql table is setup and has soemthing todo with my code.

Please if someone could help that would be great. thanks

Private Sub btnAdd_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnAdd.Click
        Dim StockcodeV As String
        Dim stockdescV As String
        Dim SellPricev As String

        StockcodeV = Me.TextBox3.Text
        stockdescV = Me.TextBox4.Text
        SellPricev = Me.TextBox5.Text

        Dim con As New SqlConnection
        Dim cmd As New SqlCommand
        Try
            con.ConnectionString = "Data Source=localhost;Initial Catalog=invsystem;Persist Security Info=True;User ID=mbish;Password=mbish"
            con.Open()
            cmd.Connection = con
            cmd.CommandText = "INSERT INTO stock(Stockcode, StockDescription,sellprice) VALUES(" & StockcodeV & "," & stockdescV & "," & SellPricev & ")"
            cmd.ExecuteNonQuery()

        Catch ex As Exception
            MessageBox.Show("Error while inserting record on table..." & ex.Message, "Insert Records")
        Finally
            con.Close()
        End Try




    End Sub
  • 3 Contributors
  • 4 Replies
  • 309 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by zifina

Dani AI

Generated

— the error came from building the INSERT SQL by concatenating raw textbox values into the command text. 's recommendation to use parameterized queries is the right direction: parameters remove the need to manually quote strings and eliminate SQL injection risk. A safer, more robust pattern is to use Using blocks and explicitly typed SqlParameters (avoid AddWithValue for production code).

Example (VB.NET, typed parameters and numeric validation):

Dim connString = "Data Source=localhost;Initial Catalog=invsystem;Persist Security Info=True;User ID=mbish;Password=mbish"

Using cn As New SqlConnection(connString)
    cn.Open()
    Using cmd As New SqlCommand("INSERT INTO stock ([Stockcode],[StockDescription],[sellprice]) VALUES (@code,@desc,@price)", cn)
        cmd.Parameters.Add(New SqlParameter("@code", SqlDbType.NVarChar, 50)).Value = TextBox3.Text
        cmd.Parameters.Add(New SqlParameter("@desc", SqlDbType.NVarChar, 250)).Value = TextBox4.Text

        Dim price As Decimal
        If Decimal.TryParse(TextBox5.Text, Globalization.NumberStyles.Number, Globalization.CultureInfo.InvariantCulture, price) Then
            Dim p As New SqlParameter("@price", SqlDbType.Decimal)
            p.Precision = 18
            p.Scale = 2
            p.Value = price
            cmd.Parameters.Add(p)

            cmd.ExecuteNonQuery()
        Else
            ' handle invalid numeric input (log, set default, skip insert, etc.)
        End If
    End Using
End Using

— two common approaches for images: store the binary in a varbinary(max) column (SQL Server 2005 supports varbinary(max)), or store files on disk and save paths in the DB. For varbinary(max) use parameterized commands and File.ReadAllBytes to get a byte() and send it as a SqlParameter with SqlDbType.VarBinary and size = -1.

Troubleshooting notes and best practice reminders: confirm column data types (sellprice should be numeric/decimal in the schema), wrap any potentially reserved names in [brackets], always validate/convert user input before assigning parameters, use Using to ensure disposal, and prefer explicit SqlParameter types for predictable behavior and performance.

Recommended Answers

All 4 Replies

Member Avatar for kvprajapati

Enclosed single quote for non-numeric value.

cmd.CommandText = "INSERT INTO stock(Stockcode, StockDescription,sellprice) VALUES('" & StockcodeV & "','" & stockdescV & "','" & SellPricev & "')"

Or, use parameterized query

...
cmd.Connection = con
cmd.CommandText = "INSERT INTO stock(Stockcode, StockDescription,sellprice) VALUES(@p1,@p2,@p3)"
cmd.Parameters.AddWithValue("@p1",StockcodeV)
cmd.Parameters.AddWithValue("@p2",stockdescV)
cmd.Parameters.AddWithValue("@p3",SellPricev)
cmd.ExecuteNonQuery()
....
Member Avatar for Mike Bishop

thanks adatapost the parameterized query is excatly what i was looking for

sorry for the newbie question.

Member Avatar for kvprajapati

You're welcome. Please mark this thread as solved if you have found an answer to your question and good luck!

Member Avatar for zifina

how to save image to sql server?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.