Adding to/Accessing a database in ASP.Net in C#

I have been working on this school assignment and have gotten to a point at which I have been stuck for a few days now. My ASP.net web page is supposed to allow the user to create an account and login. However, no matter how many times I fill in the Create Account form, it doesn't seem to get added to the database.

Here is my User class, which holds the createAccount Method

public class Userr
    {




        //Constructor for the Account Creation method(createAccount)
        public string createAccount(string strFname, string strLname, string strUname, string address, string city, string state, string phone, string zip, string email,string password)
        {
            string i="";
            string storedProcText = ("INSERT INTO User Values('@ID," +strUname +"','"+strFname +"','"+ strLname +"','"+address +"','"+city +"','"+state+"','"+zip+"','"+phone+"','"+ email +"','"+ password );

  开发者_如何学编程              ArrayList parms = null;
            DataAccess dataAccess = new DataAccess();
            int result = dataAccess.insertUpdateData(parms,storedProcText );

           i  =result.ToString();
            return i;

        }

        public string Login(string strUsername, string strPassword)
        {
            DataAccess objDA = new DataAccess();
            int result = objDA.LoginUser(strUsername, strPassword);
        }

    }

Here is my method for updating(stored in the dataAccess object/class

 //Constructor for the update method
        public int insertUpdateData(ArrayList items, String strProcedureName)
        {
            int i = 0;

            string strConn = WebConfigurationManager.ConnectionStrings["TicketsConnectionString"].ConnectionString;
            SqlConnection myConnection = new SqlConnection(strConn);

            string sqlText = strProcedureName;
            SqlCommand myCommand = new SqlCommand(sqlText);
            myCommand.Connection = myConnection;
            myCommand.CommandType = CommandType.StoredProcedure;

            try
            {
                    using (myConnection)
                {
                    myConnection.Open();
                    i = myCommand.ExecuteNonQuery();

                    //grdData.DataSource = myReader;
                   // grdData.DataBind();
                }

            } 
            catch (Exception err)
            {



            } 

            return i;
        }

The User table contains the follwing fields in order: ID, UserID, FirstName,LastName, Address, City, State, Zip,Phone,EmailAddress,Password

Is my SQL statement wrong, or what? I am at the end of my rope here.

So, off the bat, I see a few issues:

1. You set your myCommand.CommandType = CommandType.StoredProcedure but, the syntax you provided is not a stored proc. A stored proc would take a name value list of params, which is null in your case.

2. Lets say you didn't mean to use stored procs, in which case, your sql syntax is incorrect. You don't need the @ID parameter, unless you are passing it in (in which case, you didn't set it). It should be something like this (without knowing the structure of your table):

string storedProcText = ("INSERT INTO User Values("'" +strUname +"','"+strFname +"','"+ strLname +"','" + address +"','"+city +"','"+state+"','"+zip+"','"+phone+"','"+ email +"','"+ password + "'");

This is given that the values you are inserting matches your table exactly. If not, you will need to specify the table field names in your query as well, like so:

string storedProcText = ("INSERT INTO User(username, firstName, lastName, field4, field5, field6) Values("'" +strUname +"','"+strFname +"','"+ strLname +"','" + address +"','"+city +"','"+state+"','"+zip+"','"+phone+"','"+ email +"','"+ password + "'");

The way to do this using stored procs is this:

 SqlParameter[] parameters = { 
                new SqlParameter("@param1", SqlDbType.NVarChar, 50),
                new SqlParameter("@param2", SqlDbType.VarChar, 100),
                new SqlParameter("@param3", SqlDbType.VarChar, 100),
                new SqlParameter("@param4", SqlDbType.VarChar, 100),
                new SqlParameter("@param5", SqlDbType.VarChar, 100),
                new SqlParameter("@param6", SqlDbType.VarChar, 100)
            };
            parameters[0].Value = strFname;
            parameters[1].Value = strLname;
            .........
            .........
            [all the parameters you need]

You need to create a stored proc, also (obviously)

And then you call your dataaccess layer just like you are doing.

Steps for making this work: 1) Don't catch and swallow every exception. The exception will tell you what you are doing wrong here. 2) As Caspar Kleijne points out, you need to put the password in quotes. 3) As I point out, you need to add a parenthesis. 4) You should also use parameterized SQL queries 5) You probably shouldn't be passing the ID,

Here's the corrected SQL string for #2 and #3:

string storedProcText = ("INSERT INTO User Values('@ID," 
                         +strUname +"','"+strFname +"','"
                         + strLname +"','"+address +"','"
                         +city +"','"+state+"','"
                         +zip+"','"+phone+"','"
                         + email +"','"+ password 
                         +"')" );

It'll take some refactoring to use parameterized queries, and this is a homework project, so I'll leave that as an exercise for you.

So, to start from the beginning, have you stepped through this code with the debugger and determined if it's throwing an exception or returning zero rows modified?

The most worrisome thing is the insertion of the @ID column. If this is an Identity column you shouldn't be inserting this value. If it's not, I don't see you assigning a value to it anywhere.

EDIT:

So as has been mentioned by others here you have some structural issues in you query.

I took your code and threw it in a quick project and here's what your statement looks like.

INSERT INTO User Values('@ID,UserName','FirstName','LastName','123 Some Street','SomeTown','State','54555','555-444-3333','email@email.com','ITS_A_SECRET!

Notice the end of the query. The password field isn't escaped with a closing ' and the param list is not closed with a closing bracket.

A second problem is that @Id field. Is your column in the database an identity field? (It should be) If so, just remove that.

Now, here's the real kicker. Is your table name User? That's a reserved word in SQL server so you'll get errors in your query as is. Format you query like the following and it will work.

string storedProcText = ("INSERT INTO [dbo].[User] Values('" + strUname + "','" + strFname + "','" + strLname + "','" + address + "','" + city + "','" + state + "','" + zip + "','" + phone + "','" + email + "','" + password + "')");

The other issue, as mentioned is that you have the command type set to Stored Procedure when you are not using one.

Modifying you command type to text:

myCommand.CommandType = CommandType.Text;

After I made these modifications and ran your code I ended up with a record in the database.

The most important thing to check right now is that ID field. Is it an identity column? Make sure it is and then remove it from your statement.

In the insert you are trying to insert @ID which first of all most likely would be an identity column, and unless you set IDENTITY_INSERT ON on that table, will throw an exception, second, even if it was not an identity column, you are not providing the parameter definition for the @ID parameter to the command. Try removing @ID from the insert statement, and pass in everything else, but ID. As a side note, your SQL Statement is prone to SQL Injection attacks since you're concatenating sql command string and values provided by user into one string. I would recommend using parameters instead the actual values and then adding parameters to the sql command later.

I cannot post everything as a comment , but can you do one thing..

put a break point and take the contents of this string

string storedProcText = ("INSERT INTO User Values('@ID," +strUname +"','"+strFname +"','"+ strLname +"','"+address +"','"+city +"','"+state+"','"+zip+"','"+phone+"','"+ email +"','"+ password );

and paste the value of storeProcText directly in the database and see if it can successfuly run and create a record for you.

break and debug should fix your problem

Please Comment out this statement:

myCommand.CommandType = CommandType.StoredProcedure’;

You can use a sql script directly.