The data from my web page insert in SQL table as question marks

Question

I use Farsi language in my web page for inserting customer data. The data that is inserted in webpage and submitted, showed as ???? in SQL table. A lot of developers say that I should use N' before the Unicode character, but I don't know how I can use it
in my code. I attached the code. Can someone say me where I should insert the N in my code?
protected void cmdInsert_Click(object sender, EventArgs e)
//Checking the validation of required fields
if (cboCustomerType.Text == "" || cboTitle.Text == "" || SearchableName.Text == "" ||
FinalName.Text == "" || NationalID.Text == "" || BusinessID.Text == "" || MobilePhone.Text == "")
lblStatus.Text = "لطفا فیلدهای اجباری را حتما پر کنید";
return;
//define ADO.NET objects.
string insertSQL;
insertSQL = "INSERT INTO Customers(";
insertSQL += "CustomerType,CustomerTitle,CustomerFirstName,CustomerLastName,CompanyType,";
insertSQL += "CompanyName,SearchableName,FinalName,NationalCode,BusinessID,City,Address,PostalCode,";
insertSQL += "Zone,MobileNumber,WorkPhone1,WorkPhone2,HomePhone,FaxNumber,Email,Website,Note)";
insertSQL += "VALUES('";
insertSQL += cboCustomerType.Text + "','";
insertSQL += cboTitle.Text + "','";
insertSQL += CustomerFirstName.Text + "','";
insertSQL += CustomerLastName.Text + "','";
insertSQL += cboCompanyType.Text + "','";
insertSQL += CompanyName.Text + "','";
insertSQL += SearchableName.Text + "','";
insertSQL += FinalName.Text + "','";
insertSQL += NationalID.Text + "','";
insertSQL += BusinessID.Text + "','";
insertSQL += City.Text + "','";
insertSQL += Address.Text + "','";
insertSQL += PostalCode.Text + "','";
insertSQL += Zone.Text + "','";
insertSQL += MobilePhone.Text + "','";
insertSQL += Phone1.Text + "','";
insertSQL += Phone2.Text + "','";
insertSQL += HomePhone.Text + "','";
insertSQL += FaxNumber.Text + "','";
insertSQL += Email.Text + "','";
insertSQL += Website.Text + "','";
insertSQL += Note.Text + "')";
SqlConnection con = new SqlConnection(connectionString);
SqlCommand cmd = new SqlCommand(insertSQL, con);
//try to open the database and execute the insert
int added = 0;
try
con.Open();
added = cmd.ExecuteNonQuery();
lblStatus.Text = added.ToString() + "اضافه شد";
catch (Exception err)
lblStatus.Text = "Error inserting record.";
lblStatus.Text += err.Message;
finally
con.Close();
//If the insert succeed, refresh the customer list.
if (added > 0)
FillCustomerList();
Regards,

Answer 1

Because you're composing the SQL statement with string concatenation, you would put the "N" before the single quote,
VALUES(N'";
            insertSQL += cboCustomerType.Text + "',N'";
            insertSQL += cboTitle.Text + "',N'"; // ...etc
However, composing SQL statements with string concatenation is not a suggested practice because it's open to SQL injection (see:
https://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx). A safer way to do this is to use command parameters to represent the values (see SqlCommand.Parameters
property). If you use parameters, you can specify parameter data type as SqlDbType.NVarchar, which will ensure your text values are passed in as Unicode. Also ensure that the columns in question are defined in the database table definition as Unicode (NVARCHAR
rather than VARCHAR).
Hope this helps, Bob