Sql C# Incorrect syntax near

Question

I tried to make a code to insert all my data from a grid into a table. In the grid I display what I need, it's not the problem, or it does not give an error

Displays this error:

System.Data.SqlClient.SqlException: Incorrect syntax near '{'

string StrQuery;
                try
                {
                    using (SqlConnection conn = new SqlConnection(stringcon))
                    {
                        using (SqlCommand comm = new SqlCommand())
                        {
                            comm.Connection = conn;
                            conn.Open();
                            for (int i = 1; i < bunifuCustomDataGrid2.Rows.Count; i++)
                            {
                           StrQuery = @"INSERT INTO concediati VALUES ("
                            + bunifuCustomDataGrid2.Rows[i].Cells["firstname"].ToString() + ", "
                             + bunifuCustomDataGrid2.Rows[i].Cells["lastname"].ToString() + ", "
                             + bunifuCustomDataGrid2.Rows[i].Cells["CARS"].ToString() + ", "
                             + bunifuCustomDataGrid2.Rows[i].Cells["RENT"].ToString() + ", "
                            + bunifuCustomDataGrid2.Rows[i].Cells["CLIENT"].ToString() + ");";
                        comm.CommandText = StrQuery;
                        comm.ExecuteNonQuery();
                            }
                        }
                    }
                }
                catch (Exception)
                {
                    throw;
                }

Updated with parameters.

string StrQuery;
            try
            {
                using (SqlConnection conn = new SqlConnection(stringcon))
                {
                    using (SqlCommand comm = new SqlCommand())
                    {
                        comm.Connection = conn;
                        conn.Open();
                        for (int i = 0; i < bunifuCustomDataGrid2.Rows.Count; i++)
                        {


                            StrQuery = @"INSERT INTO concediati(nume,prenume,idcar,idrent,idclient) VALUES (@name,@lastname,@car,@rent,@client)";
                            comm.Parameters.AddWithValue("@name", Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["firstname"].ToString()));
                            comm.Parameters.AddWithValue("@lastname", Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["lastname"].ToString()));
                            comm.Parameters.AddWithValue("@car", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CARS"].ToString()));
                            comm.Parameters.AddWithValue("@rent", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["RENT"].ToString()));
                            comm.Parameters.AddWithValue("@client", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CLIENT"].ToString()));



                            comm.CommandText = StrQuery;
                            comm.ExecuteNonQuery();
                        }
                    }
                }
            }
            catch (Exception)
            {
                throw;


}

And now it gives a different error:

System.FormatException: 'Input string was not in a correct format.'

Pictures: capture1 capture25 capture25 capture25 capture5

Table:

CREATE TABLE [dbo].[concediati] (
    [Id]       INT          IDENTITY (1, 1) NOT NULL,
    [nume]     VARCHAR (50) NULL,
    [prenume]  VARCHAR (50) NULL,
    [idclient] INT          NULL,
    [idrent]   INT          NULL,
    [idcar]    INT          NULL,
    PRIMARY KEY CLUSTERED ([Id] ASC)
);

Answer 1

I checked your code and made this change. You can use the following code.

 string StrQuery;
        try
        {
            using (SqlConnection conn = new SqlConnection(stringcon))
            {

                    for (int i = 0; i < bunifuCustomDataGrid2.Rows.Count; i++)
                    {
                        SqlCommand comm = new SqlCommand();
                        comm.Connection = conn;
                        StrQuery = @"INSERT INTO concediati(nume,prenume,idcar,idrent,idclient) VALUES (@name,@lastname,@car,@rent,@client)";
                        comm.Parameters.AddWithValue("@name", Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["firstname"].ToString()));
                        comm.Parameters.AddWithValue("@lastname", Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["lastname"].ToString()));
                        comm.Parameters.AddWithValue("@car", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CARS"].ToString()));
                        comm.Parameters.AddWithValue("@rent", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["RENT"].ToString()));
                        comm.Parameters.AddWithValue("@client", Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CLIENT"].ToString()));

                        comm.CommandText = StrQuery;

                        conn.Open();
                        comm.ExecuteNonQuery();
                        conn.Close();

                    }
                }

        }
        catch (Exception ex)
        {
            throw;
        }

Answer 2

The documentation for INSERT shows a space between the table name and the list of columns, so it would be best to follow that.

Also, you can create the parameters just once outside the loop and set their values in the loop (otherwise you would need to call .Clear() on the parameters and re-create them on every iteration):

string sql = @"INSERT INTO concediati (nume, prenume, idcar, idrent, idclient) VALUES (@name, @lastname, @car, @rent, @client)";
using (SqlConnection conn = new SqlConnection(stringcon))
{
    using (SqlCommand comm = new SqlCommand(sql, conn))
    {
        comm.Parameters.Add(new SqlParameter { ParameterName = "@name", SqlDbType = SqlDbType.VarChar, Size = 50 });
        comm.Parameters.Add(new SqlParameter { ParameterName = "@lastname", SqlDbType = SqlDbType.VarChar, Size = 50 });
        comm.Parameters.Add(new SqlParameter { ParameterName = "@car", SqlDbType = SqlDbType.Int });
        comm.Parameters.Add(new SqlParameter { ParameterName = "@rent", SqlDbType = SqlDbType.Int });
        comm.Parameters.Add(new SqlParameter { ParameterName = "@client", SqlDbType = SqlDbType.Int });

        conn.Open();

        for (int i = 0; i < bunifuCustomDataGrid2.Rows.Count; i++)
        {
            string firstName = Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["firstname"].Value);
            string lastName = Convert.ToString(bunifuCustomDataGrid2.Rows[i].Cells["lastname"].Value);
            int car = Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CARS"].Value);
            int rent = Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["RENT"].Value);
            int client = Convert.ToInt32(bunifuCustomDataGrid2.Rows[i].Cells["CLIENT"].Value);

            comm.Parameters["@name"].Value = firstName;
            comm.Parameters["@lastname"].Value = lastName;
            comm.Parameters["@car"].Value = car;
            comm.Parameters["@rent"].Value = rent;
            comm.Parameters["@client"].Value = client;

            comm.ExecuteNonQuery();

        }
    }
}

Answer 3

bunifuCustomDataGrid2.Rows[i].Cells["firstname"].ToString()) gives you the overriden implementation of ToString method. That means you are not getting the actual values from above code. You should use bunifuCustomDataGrid2.Rows[i].Cells["firstname"].Value instead.

Please mark it as answered if it helps.