Please help me with my code

[Patch2012]

C# Need help

Any Idea, what is wrong with my code?
error says -> ExecuteNonQuery: Connection property has not been initialized.

any body can correct my code please...

#region RegisterButton
private void btnRegister_Click(object sender, EventArgs e)
{
try
{
SqlConnection con = new SqlConnection(@"Data Source=TEST-PC\SQLEXPRESS;Initial Catalog=DBServer;Integrated Security=True");
con.Open();
SqlCommand cmd = new SqlCommand(@"insert into TblAccounts(Names,Lnames,Midnames,Address,Cnumber)
values ('" + txbxName.Text + "','" + txbxLName.Text + "', '" + txbxMName.Text + "', '" + txbxAddrss.Text + "', '" + txbxCNum.Text + "')");



cmd.ExecuteNonQuery();
con.Close();
}
catch (Exception ex) {MessageBox.Show(ex.Message);}
}
#endregion

Also I have created a stored procedure on the database side. But I can't remember how to use this into c#

create procedure storeAccs
(
@Names nvarchar(50),
@Lnames nvarchar(50),
@midnames nvarchar(50),
@Address nvarchar(50),
@Cnumber int,
)
as
begin

insert into TblAccounts(Names,Lnames,Midnames,Address,Cnumber)
valuesTblAccounts @Names,@Lnames @midnames,@Address,@Cnumber)


end

 

[Ben]

Re: [Tutorial Requests]

However that this is not a tutorial request, you need to pass ur SqlConnection object to the SqlCommand.
In the SqlCommand you should have a second constructor with Query,SqlConnection.

 

[Patch2012]

Re: [Tutorial Requests]

However that this is not a tutorial request, you need to pass ur SqlConnection object to the SqlCommand.
In the SqlCommand you should have a second constructor with Query,SqlConnection.

How to pass ur SqlConnection object to the SqlCommand?

 

[Ben]

Re: [Tutorial Requests]

How to pass ur SqlConnection object to the SqlCommand?

new SqlConnection(string query, SqlConnection connect);

Check MSDN.

 

[Patch2012]

Re: [Tutorial Requests]

new SqlConnection(string query, SqlConnection connect);

Check MSDN.

Thank you so much ben.

I have figure it out what is miss with my code. It's just I have for got to initialize the connection.

SqlCommand cmd = new SqlCommand(@"insert into TblAccounts(Names,Lnames,Midnames,Address,Cnumber)
values ('" + txbxName.Text + "','" + txbxLName.Text + "', '" + txbxMName.Text + "', '" + txbxAddrss.Text + "', '" + txbxCNum.Text + "')",con);

 

[Aesir]

I count 5 potential SQL injections in just one line, thats a record

 

[Ben]

I count 5 potential SQL injections in just one line, thats a record

He should use parameters, would be a much more secure way.

 

[Aesir]

He should use parameters, would be a much more secure way.

Would be even easier supply them instead of concatenate a string each time he need to supply one.

 

[Patch2012]

He should use parameters, would be a much more secure way.

Hi Ben, I'm just starting to learn c# may I know how to use parameters?

 

[Ben]

Hi Ben, I'm just starting to learn c# may I know how to use parameters?

https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.parameters(v=vs.110).aspx