Is it possible to insert data in to table through coding with out using table name

My question is generally we write the follo开发者_JAVA百科wing through code while we are inserting data to a table

     insert into tblname values('"+txt.text+"','"+txt1.text+"');

As we pass the data form the text boxes like that is it possible to insert in to table with out using table name directlty

Well you obviously need to know what table to insert into, so there has to be a table name identified to the INSERT statement. The options include:

1. an INSERT statement with actual table name as per your existing example
2. an INSERT statement with a synonym as the target (alias for an actual table - see: http://blog.sqlauthority.com/2008/01/07/sql-server-2005-introduction-and-explanation-to-synonym-helpful-t-sql-feature-for-developer/)
3. an INSERT statement with an updateable view as the target
4. a sproc call whereby the sproc knows the table to INSERT into (but the calling code does not need to know)

You should also be aware of SQL injection risks with your example - avoid concatenating values directly into a SQL string to execute. Instead, parameterise the SQL.

If you need to dynamically specify the table to insert into at run time, you have to concatenate the table name into the SQL statement you then execute. However, be very wary of SQL injection - make sure you fully validate the tablename to make sure there are no nasties in it. You could even check it is a real table by checking for it in sys.tables.

Not possible without name of table.

But you can make use of Linq To SQL (i.e any ORM) or DataAdapter.Update if you have filled it with the proper table....

You cannot do that without the table name, no. However, the bigger problem is that your code is horribly dangerous and at rick from SQL injection. You should fix this right now, today, immediately. Injection, even for internal apps, is the single biggest risk. Better code would be:

 insert into tblname (Foo, Bar) values(@foo, @bar)

adding the parameters @foo and @bar to your command (obviously, replace with sensible names).

Before you ask: no, the table name cannot be parameterised; you cannot use

insert into @tblname -- blah

The table name(s) is(/are) fundamental in any query or operation.

I suppose that if it's possible you have to use parameters.

Here you have a little example.