Member Avatar for sonia sardana

I have made connection in web.config file,Its working ,I want to just confirmed dat Whether i m doing it in right way or not!


Web.Config File-

<configuration>
	<appSettings/>
	<connectionStrings>
		<add name="Connection" connectionString="Data Source=(local);Initial catalog=sonia;User ID=sonia;Password=sonia;" providerName="System.Data.SqlClient"/>
	</connectionStrings>

Code Behind Page

public partial class FrmPractise : System.Web.UI.Page
{
    SqlConnection conn =new SqlConnection (ConfigurationManager.ConnectionStrings["Connection"].ConnectionString ) ; 
        string query;
    SqlCommand cmd;

    
    protected void btnInsertData_Click(object sender, EventArgs e)
    {
        try
        {
         
            query = "Insert into testing values(@EmpId,@EmpName)";
            cmd=new SqlCommand (query ,conn ) ;
            cmd .Parameters .AddWithValue ("@EmpId",txtEmpId .Text ) ;
            cmd.Parameters .AddWithValue ("@EmpName",txtEmpName .Text ) ; 
            conn .Open ();
            cmd.ExecuteNonQuery ();
            conn .Close ();

        }

        catch (Exception ex)
        {
        lblError .Text =ex.Message .ToString ();
        }


    }

I have small probs more

query = "Insert into testing values('" & txtEmpId.Text & "','" & txtEmpName.Text & "')";

is there any error in the above line,I m getting Error -
Error 1 Operator '&' cannot be applied to operands of type 'string' and 'string'

  • 3 Contributors
  • 5 Replies
  • 113 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by sonia sardana

Dani AI

Generated

Your web.config approach works and, as pointed out, the concatenation problem came from using VB syntax in a C# file. A few practical, low-risk improvements and checks will make the code more robust and secure.

Use scoped disposal instead of a long-lived SqlConnection field. That guarantees the connection is closed even on exceptions. For example, open a connection only inside the button handler and dispose it with using so you never leave connections open:

using (var conn = new SqlConnection(cs))
{
    conn.Open();
    using (var cmd = new SqlCommand("INSERT INTO testing (EmpId, EmpName) VALUES (@id, @name)", conn))
    {
        cmd.Parameters.Add("@id", SqlDbType.Int).Value = int.Parse(txtEmpId.Text);
        cmd.Parameters.Add("@name", SqlDbType.NVarChar, 100).Value = txtEmpName.Text;
        cmd.ExecuteNonQuery();
    }
}

Prefer explicitly typed parameters instead of relying on AddWithValue (it can cause type mismatches and performance issues). Validate and convert user input (e.g., parse integers) before assigning to parameters to avoid runtime exceptions.

Protect connection credentials: use Windows/Integrated Security where possible, or encrypt the connectionStrings section in production (see Microsoft docs on protecting connection strings). Always favor parameterized commands or stored procedures over string concatenation to prevent SQL injection; refer to the SQL Injection guidance for details.

Relevant references:

Notes tied to the thread: your setup was basically fine; ’s comment about concatenation was correct; ’s reassurance fits—just apply the safety/maintenance tweaks above for production-ready code.

Recommended Answers

All 5 Replies

Member Avatar for sknake

Try:

query = "Insert into testing values('" + txtEmpId.Text + "','" + txtEmpName.Text + "')"; query = "Insert into testing values('" + txtEmpId.Text + "','" + txtEmpName.Text + "')";

In C# you use + to concatenate strings, not the VB & operator.

Member Avatar for anuj_sharma

If it is workinh fine then you must have done it the right way..
Don't doubt yourself dear...

Member Avatar for sonia sardana

But i m newbie to ASP,dats y doubt is there!!

Member Avatar for sknake

Well you did it right! :)
Did the + operator fix the problem you were having with the string concatenation?

Member Avatar for sonia sardana

Yes sir Thx........

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.