Writing values to sql database

I am trying to write three variables into a database table. The code I have is:

sqlCmd.CommandText = "INSERT INTO dbo.PortfolioValues(StudentNumber,TimeStamp,PortfolioValue) VALUES(StudentNumber.ToString() , Time.ToString() , Total.ToString())" + dbConnection;
                sqlCmd.ExecuteNonQuery();
      开发者_运维问答          sqlTran.Commit();

dbconnection is the name of the connection. It does not do anything. It is in a try-catch but goes straight to catch. Thanks in advance.

You should

• avoid concatenating together your SQL statement - avoid SQL injection attacks! Use parametrized queries instead!
• use using blocks for your SqlConnection and SqlCommand objects

Try something like this:

string _connString = "........";

string queryStmt =
   "INSERT INTO dbo.PortfolioValues(StudentNumber, TimeStamp, PortfolioValue) " +
   "VALUES(@StudentNumber, @TimeStamp, @TotalValue)";

using(SqlConnection _con = new SqlConnection(_connString))
using(SqlCommad _cmd = new SQlCommand(queryStmt, _con))
{
   // create paramters and set values
   _cmd.Parameters.Add("@StudentNumber", SqlDbType.Int).Value = StudentNumber;

   // do the same for the other two parameters

   try
   {
      _con.Open();
      _cmd.ExecuteNonQuery();
      _con.Close();
   }
   catch(Exception exc)
   {
      // handle exception
   }
}

StudentNumber.ToString() cannot be contained in a query! It's java code not sql...

//Am asuming you are using C# and the System.Data.SqlClient
//here is how you might do what you want

private static void CreateCommand(string queryString,
    string connectionString)
{
    using (SqlConnection connection = new SqlConnection(
               connectionString))
    {
        SqlCommand command = new SqlCommand(queryString, connection);
        command.Connection.Open();
        command.ExecuteNonQuery();
    }
}

//so that you use it this way:

String query = String.Formart("INSERT INTO dbo.PortfolioValues(StudentNumber,TimeStamp,PortfolioValue) VALUES(\"{0}\",\"{1}\",\"{2}\")",StudentNumber.ToString() , Time.ToString() , Total.ToString());

String connectionString = "your connection string";

CreateCommand(query,connectionString);