Hi There,
In .Net there are many ways of interacting with a database, but as you mention parameters in your post, I assume that you want to use the connected method of data access that doesn't use data sets and data adapters.
Here are a few pointers, and a code sample:
1. If you are going to use sql statements in your code rather than stored procedures it is VERY IMPORTANT to use parametrized queries (example below), instead of creating query by directly from the values of form fields. Parameters in .net check their contents for malicious input (such as a sql injection - see google) before creating the query.
2. Although you can use Request.Form/QueryString in asp.net, it is not recommended. Instead you should access the form field objects' (eg TextBox) through their properties (eg for TextBox, .Text).
Here is the Aspx Code:
Code:
<form id="form1" runat="server">
<div>
<asp:TextBox ID="txtInputOne" runat="server"></asp:TextBox><br />
<asp:TextBox ID="txtInputTwo" runat="server"></asp:TextBox><br />
<asp:Button ID="btnSubmit" runat="server" OnClick="btnSubmit_Click" Text="Submit" />
</div>
</form>
Here is the code behind for the button event handler (in c#, if can't convert to
vb then let me know):
Code:
protected void btnSubmit_Click(object sender, EventArgs e)
{
//set up the connection
SqlConnection conn = new SqlConnection("your connection string");
//set up the command, using the sql and the connection made in the previous line
//each inserted value is represented by a parameter (@field1 and @field2)
SqlCommand insertCommand = new SqlCommand("insert into table set field1 = @field1, field2 = @field2", conn);
//create parameter objects for each parameter in the previous line
SqlParameter parField1 = new SqlParameter("@field1", SqlDbType.VarChar);
SqlParameter parField2 = new SqlParameter("@field2", SqlDbType.VarChar);
//assign the values of the text boxes to the parameters
//the .Text property is the asp.net method of doing Request.Form of Request.QueryString
parField1.Value = txtInputOne.Text;
parField2.Value = txtInputTwo.Text;
//add the parameters to the previously created insert command
insertCommand.Parameters.Add(parField1);
insertCommand.Parameters.Add(parField2);
//put db execution inside try catch as db exceptions are common
try
{
//open the connection
conn.Open();
//this line actually executes your command and returns the number of rows affected
int rowsAffected = insertCommand.ExecuteNonQuery();
}
catch (Exception ex)
{
//log exception or provide custom logic to give error message
}
finally
{
//ensure that the connection object is cleaned up, freeing resources on the db server
conn.Close();
conn.Dispose();
}
}
I hope this helps,
Rich
Insert Variable Value into DB
