Insert into Oracle Database using C#

Question

Hi Everyone,
I am trying to take data from text box and list box and then insert them to Oracle database:
Text box data:
Oracle = EMPLOYEE_NAME
C# = tbEmployeeName
List box data:
Oracle = EMPLOYEE_GENDER
C# = lbEmployeeGender
Here is my code in C#, can you guys help me with insert statement:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (tbEmployeeName.Text, lbEmployeeGender.Text)";
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
MessageBox.Show("Record not inserted");
else
MessageBox.Show("Success!");
conn.Dispose();
Thanks!

Answer 1

989630 wrote:
Hi Everyone,
I am trying to take data from text box and list box and then insert them to Oracle database:
Text box data:
Oracle = EMPLOYEE_NAME
C# = tbEmployeeName
List box data:
Oracle = EMPLOYEE_GENDER
C# = lbEmployeeGender
Here is my code in C#, can you guys help me with insert statement:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (tbEmployeeName.Text, lbEmployeeGender.Text)";
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
MessageBox.Show("Record not inserted");
else
MessageBox.Show("Success!");
conn.Dispose();
Thanks!Hi,
You'll want to read up on using parameters (also known as bind variables) - these are critical for scalability in an OLTP-type system and helping guard against SQL Injection attacks. There's many sources out there, but here's a link to the Parameter Binding section in the ODP.NET Developer's Guide which is probably a good thing to become familiar with:
http://docs.oracle.com/cd/E11882_01/win.112/e23174/featOraCommand.htm#i1007242
Here's your sample using bind variables:
string oradb = "Data Source= oraDB;User Id=sm;Password=mypassword;";
OracleConnection conn = new OracleConnection(oradb);
conn.Open();
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
// Perform insert using parameters (bind variables)
cmd.CommandText = "Insert into USER.EMPLOYEE VALUES (:1, :2)";
// Here's one way to use parameters aka bind variables:
// Create parameters to hold values from front-end
cmd.Parameters.Add(new OracleParameter("1",
                                       OracleDbType.Varchar2,
                                       tbEmployeeName.Text,
                                       ParameterDirection.Input));
cmd.Parameters.Add(new OracleParameter("2",
                                       OracleDbType.Varchar2,
                                       lbEmployeeGender.Text,
                                       ParameterDirection.Input));
int rowsUpdated = cmd.ExecuteNonQuery();
if (rowsUpdated == 0)
  MessageBox.Show("Record not inserted");
else
  MessageBox.Show("Success!");
conn.Dispose();
// don't forget to perform any clean-up as necessaryNote that I've just typed this into a text editor and not verified, so please excuse any typos you may find.
Also, I've allowed the default of OracleCommand.BindByName=false as I prefer that, though others certainly prefer setting it to "true". See the docs for what this means if you are not sure.
Regards,
Mark