Reputation: 1
I have one question and was wondering if someone could help.. I have created a program in vb net. When I press a button then it should insert in my sql database in the column "date" the current date and time. I use for this purpose the following code :
query1 = "insert into visit(visit,textfile,p_id) VALUES('" & Date.Today & "','" & s & "',(select patient.p_id from patient where (patient.name=('" & ComboBox1.Text & " '))))"
Well it does its job but when i look in my database in the column 'visit' it displays only zeros.
Any ideas?
Upvotes: 0
Views: 306
Reputation: 216293
Use a parameterized query (this example is for Sql Server). In this way you don't need to worry how to quote a date, a string or what is the correct decimal separator required by the database.
Moreover you avoid any problem with Sql Injection attacks
query1 = "insert into visit(visit,textfile,p_id) VALUES(@p1, @p2, " & _
"(select patient.p_id from patient where patient.name=@p3)"
Dim cmd As MySqlCommand = new MySqlCommand(query1, connection)
cmd.Parameters.AddWithValue("@p1", Date.Today)
cmd.Parameters.AddWithValue("@p2", s)
cmd.Parameters.AddWithValue("@p3", ComboBox1.Text)
cmd.ExecuteNonQuery()
Upvotes: 2