Error found while saving. System.Data.OleDb.OleDbException (0x80040E10): No value given for one or more required parameters.

Question

Hello Friends
I am facing problem while saving the data into the ms access 2007.
Below picture shows my database and table
Below picture shows my error log.
Here is my GettingCategoryId() method code.
private OleDbCommand GettingCategoryId()
OleDbCommand cmd2 = new OleDbCommand("select * from tbl_category where category_name='" + combobox_category_name.Text + "' ", GlobalVarClass.globalCon);
OleDbDataReader dr = cmd.ExecuteReader();
while (dr.Read())
textBox1.Text = Convert.ToString(dr.GetInt32(0));
return cmd2;
Here is my conv_photo() method code.
void conv_photo()
//converting photo to binary data
if (pictureBox1.Image != null)
ms = new MemoryStream();
pictureBox1.Image.Save(ms, ImageFormat.Jpeg);
byte[] photo_aray = new byte[ms.Length];
ms.Position = 0;
ms.Read(photo_aray, 0, photo_aray.Length);
cmd.Parameters.AddWithValue("@item_image", photo_aray);
Here is my connection string.
public static string gloabal_connection_string = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source= " + Application.StartupPath + "\\pos_fircos.accdb";
public static OleDbConnection globalCon = new OleDbConnection(gloabal_connection_string);
This is my saving code.
OleDbCommand cmd = GettingCategoryId();
cmd = new OleDbCommand("INSERT INTO tbl_items(category_id,item_no,item_model,item_description,item_sale_price,item_image)Values('" + Convert.ToInt32(textBox1.Text) + "','" + Convert.ToString(textbox_item_no.Text) + "','" + Convert.ToString(textbox_item_model.Text) + "','" + Convert.ToString(textbox_item_description.Text) + "','" + Convert.ToDouble(textbox_item_sale_price.Text) + "',@item_image)", GlobalVarClass.globalCon);
conv_photo();
cmd.ExecuteNonQuery();
Please give me solution this problem.
Waiting for your reply.
Thanks and regards
Your truly,
Hasnain Ahmad
[email protected]

Answer 1

I strongly recommend that you change your command from using string formatting to build up the command to a simple command that uses parameters.  This will: a) clean up your code so it is understandable, b) prevent SQL injection attacks which your current
code is fully vulnerable to, c) help more easily identify which parameter you aren't actually setting.
//Not validated against the compiler so there may be syntax errors
var cmd = new OleDbCommand("INSERT INTO tbl_items(category_id,item_no,item_model,item_description,item_sale_price,item_image) Values (@categoryId, @itemNo, @itemModel, @itemDescription, @itemPrice, @itemImage)", GlobalVarClass.globalCon);
cmd.Parameters.AddWithValue("@categoryId", Convert.ToInt32(textBox1.Text));
cmd.Parameters.AddWithValue("@itemNo", textbox_item_no.Text);
cmd.Parameters.AddWithValue("@itemModel", textbox_item_model.Text);
cmd.Parameters.AddWithValue("@itemDescription", textbox_item_description.Text);
cmd.Parameters.AddWithValue("@itemPrice", Convert.ToDouble(textbox_item_sale_price.Text));
//This is the parameter that doesn't seem to have any value so replace ?? with the variable holding the value of the image
cmd.Parameters.AddWithValue("@itemImage", ??);
conv_photo();
cmd.ExecuteNonQuery();
Michael Taylor
http://blogs.msmvps.com/p3net