Syntax error in INSERT INTO statement (Microsoft Access)

Question

I am using Visual Studio 2010 connected to an Access database (2010).

I created a button to add items from textboxes to the database and I'm getting the error "Syntax error in INSERT INTO statement"

    protected void upload_Click(object sender, EventArgs e)
{
    if (FileUpload3.HasFile)
    {
        try
        {
            string filename = Path.GetFileName(FileUpload3.FileName);
            FileUpload3.SaveAs(Server.MapPath("images") + "/" + filename);
            Picture.Text = "images/" + filename;
            Label2.Text = "";
        }
        catch (Exception ex)
        {

            Label2.Text = "Upload status: The file could not be uploaded. The following error occured: " + ex.Message;
        }



    }
}

protected void addnewitem_Click(object sender, EventArgs e)
{


    AccessDataSource1.InsertCommand = "Insert into RAM (RAM Name, picture) values ('" + name.Text.ToString() + ",'" + Picture.Text.ToString() + "')";

    AccessDataSource1.Insert();
}

Encapsulate the field [RAM Name] in square brackets. I think the error is due to space in the column name. "Insert into RAM ([RAM Name], picture) values" — Alberto Spelta, Apr 18 '13 at 12:32

score 1 · Accepted Answer · edited May 23 '17 at 11:43

Try a bit of SQL injection: append a single quote to the text you enter in the "name" textbox.

And if it works, then use parameters in your query rather than appending text from the user.

Further reading:

http://www.codinghorror.com/blog/2005/04/give-me-parameterized-sql-or-give-me-death.html

How do parameterized queries help against SQL injection?

UPDATE

Also use the correction in Alberto Spelta's comment on the original question (enclose a column name that contains spaces in brackets: "RAM Name" => "[RAM Name]"). This is another syntax error as well as the omitted single quote.

score 1 · Answer 2 · answered Apr 18 '13 at 12:33

You're missing a single quote:

"... values ('" + name.Text.ToString() + "','" + Picture.Text.ToString() + "')"
                                          ^

But you shouldn't be using string concatentation like this - use a proper parameterised query instead, and you won't see these problems (or the more dangerous injection problems you get when your data contains single quotes).

score 1 · Answer 3 · edited Apr 19 '13 at 17:38

1

Try

([RAM Name], picture)

instead of

(RAM Name, picture)

Hope this helps

edited Apr 19 '13 at 17:38

Irvin Dominin

30,819
9
77
111

answered Apr 19 '13 at 17:03

Peter De Baets

11
1

Syntax error in INSERT INTO statement (Microsoft Access)

3 Answers3