Reputation: 21280
Any idea why I am getting this exception ?
My create Table looks like this:
string.Format("CREATE TABLE IF NOT EXISTS `{0}` ( `id` int(11) NOT NULL auto_increment, `CAMXTime` DATETIME ,`Message` LONGTEXT , PRIMARY KEY (`id`));", GlobalVariables.CamxmassagesTable);
And insert statement looks like
string.Format("INSERT INTO `{0}` (`CAMXTime` , `Message`) VALUES (`{1}`,`{2}`);", GlobalVariables.CamxmassagesTable, newNode.Item1, newNode.Item2);
newNode.Item1
is from type DATETIME
.
newNode.Item2 i
s a string
.
Any idea ?
Upvotes: 0
Views: 2498
Reputation: 225105
You should be using single quotes in your values (and, of course, escaping them in the first place). So the INSERT
statement should be:
string.Format(
"INSERT INTO `{0}` (`CAMXTime` , `Message`) VALUES ('{1}','{2}');", // ` to '
GlobalVariables.CamxmassagesTable,
newNode.Item1.Replace("'", "''"),
newNode.Item2.Replace("'", "''")
);
Not that you should use that way to execute SQL queries nor to escape values, but it's marginally better.
Edit: Use parametrized queries.
Upvotes: 3