Programming Forums

Programming Forums (http://www.programmingforums.org/forumindex.php)
-   C# (http://www.programmingforums.org/forum16.html)
-   -   i'm trying to use c# with mysql (http://www.programmingforums.org/showthread.php?t=13415)

programmingnoob Jun 23rd, 2007 4:11 AM

i'm trying to use c# with mysql
 
what if I want to insert things in a mysql table using data from a c# array?
it's a lot easier if i am just trying to hardcode values into the table, for example,
:

command.CommandText = "insert profilet (id, firstn, lastn) values (1, 2, 3)";
would work fine...
but the line below would not quite work...
:

command.CommandText = "insert profilet (id, firstn, lastn) values (array[0], array[2], array[3])";
please let me know if my question doesnt make sense...
any suggestions, please?

Samuaijack Jun 23rd, 2007 9:06 AM

command.CommandText = "insert into profilet (id, firstn, lastn) values (array[0], array[2], array[3])";

teishu Jun 23rd, 2007 11:55 AM

you need to use quotations, that will just insert the words array[0] etc..

command.CommandText = "insert profilet (id, firstn, lastn) values ("array[0]", "array[2]", "array[3])"";

john Wesley Jun 23rd, 2007 2:11 PM

Samuraijack's will insert those words as you say however your command string should not compile at all!

"INSER INTO profilet (id, firstn, lastn) VALUES (" + array[0] + "," + array[1] + "," + array[2] + ")";

The above command string should do what you want it to programmingnoob, considering you have an initialised array of objects named 'array' and those numbers are valid index identifiers.

programmingnoob Jun 23rd, 2007 10:47 PM

Quote:

Originally Posted by teishu (Post 129588)
you need to use quotations, that will just insert the words array[0] etc..

command.CommandText = "insert profilet (id, firstn, lastn) values ("array[0]", "array[2]", "array[3])"";

but thats not what I want to do....
I want to insert the value of array[0] and so on...

for example, if array[0] = 11, array[2] = 15...
I would want 11 and 15 inserted into the table... not the words array[0] etc

xavier Jun 24th, 2007 1:26 AM

as john Wesley said :
:

INSER INTO profilet (id, firstn, lastn) VALUES ('" + array[0] + "','" + array[1] + "','" + array[2] + "')";

I just added the ' .. i remember it's necessary for inserting strings.

On the other hand, take a look at MySqlParameter.(aka google_it)

InfoGeek Jun 24th, 2007 3:58 AM

I suggest using parameterized queries instead of simple concatenation to aviod sql injection attacks.

teishu Jun 24th, 2007 12:09 PM

Quote:

Originally Posted by programmingnoob (Post 129594)
but thats not what I want to do....
I want to insert the value of array[0] and so on...

for example, if array[0] = 11, array[2] = 15...
I would want 11 and 15 inserted into the table... not the words array[0] etc

precisely, yours would have inserted the words 'array[0]' etc..

look at the pairs of quotations more carefully and you will understand..

Thanks john wesley for completing my code, i knew it was close, not done it for a while lol..

programmingnoob Jun 27th, 2007 4:02 AM

Quote:

Originally Posted by InfoGeek (Post 129605)
I suggest using parameterized queries instead of simple concatenation to aviod sql injection attacks.

umm elaborate please?!
I'm new to this stuff you see
if you could point me to a weblink, then that would be great too

free-zombie Jun 27th, 2007 9:24 AM

I don't know how it's done in C# with whatever MySQL API you're using, but this is the same thing in python:

:

cursor.execute('insert into profilet (id, firstn, lastn) values (%s, %s, %s)', array[:3])

the point is that the SQL library takes care of putting the values into the query with correct quoting as to avoid danger if someone sets array[2] to something like Butcher"); update profilet set ( firstn = "idiot (you get the general idea)


All times are GMT -5. The time now is 2:34 AM.

Powered by vBulletin® Version 3.7.0, Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Copyright ©2007 DaniWeb® LLC