c# - Insert and update a datetime into SQL database -

private void buttonok_click(object sender, eventargs e)     {         if (txtwedstrijdschemaid.text == "")         {             //insert             string sql;             sql = "insert wedstrijdschema (team1, team2, datum)";             sql += " values (";             sql += "" + txtteam1.text + ",";             sql += "" + txtteam2.text + ",";             sql += "" + convert.todatetime(txtdatum.text) + "";             sql += ")";              cldatabase.executecommand(sql);             vullv();         }         else         {             //update             string sql;             sql = "update wedstrijdschema set ";             sql += "team1 = " + txtteam1.text + ",";             sql += "team2 = " + txtteam2.text + ",";             sql += "datum = " + convert.todatetime(txtdatum.text) + "";             sql += " schemaid = " + zoek;              cldatabase.executecommand(sql);             vullv();         }         txtdatum.enabled = txtteam2.enabled = txtteam1.enabled = false;     } 

that have, because of trycatch won't crash when try, if comment txtdatum.text out on //insert , //upload works (but enters null datum in database) perhaps see i'm going wrong?

edit: use of parameters, need use threetier system sql goes through class 1 allowed database, how command executed:

public static bool executecommand(string sqlinstructie)         {             bool retour = true;             sqlconnection conn = new sqlconnection(clstam.connstr);             sqlcommand cmd = new sqlcommand(sqlinstructie, conn);              try             {                 cmd.connection.open();                 cmd.executenonquery();             }             catch             {                 retour = false;             }                         {                 conn.close();             }             return retour;         } 

this works!! lot help:

private void buttonok_click(object sender, eventargs e)         {             if (txtwedstrijdschemaid.text == "")             {                 //insert                  string sql;                 sql = "insert wedstrijdschema (team1, team2, datum)";                 sql += " values (";                 sql += "" + txtteam1.text + ",";                 sql += "" + txtteam2.text + ",";                 sql += "'" + convert.todatetime(txtdatum.text) + "'";                 sql += ")";                 debug.writeline(sql);                 cldatabase.executecommand(sql);                 vullv();             }             else             {                 //update                 string sql;                 sql = "update wedstrijdschema set ";                 sql += "team1 = " + txtteam1.text + ",";                 sql += "team2 = " + txtteam2.text + ",";                 sql += "datum = '" + convert.todatetime(txtdatum.text) + "'";                 sql += " schemaid = " + zoek;                  cldatabase.executecommand(sql);                 vullv();             }             txtdatum.enabled = txtteam2.enabled = txtteam1.enabled = false;         } 

edit: i'll promise use parameterized sql on!

you missing command , insert , update statement.

the syntax insert data database is:

 insert table          (column1, column2, column3)   values         ('value 1', 'value 2', 'value3') 

aside that, vulnerable sql injection, use sql paramerterised queries prevent this.

i first start off using sqlcommand object.

sqlcommand cmd = new sqlcommand("insert wedstrijdschema (team1, team2, datum) values (@v1, @v2, @v3");  cmd.parameters.addwithvalue("@v1", txtteam1.text); cmd.parameters.addwithvalue("@v2", txtteam2.text); cmd.parameters.addwithvalue("@v3", convert.todatetime(txtdatum.text)); 

and execute using cmd.executenonquery();

as additional note ensure value in txtdatum converted correctly desired date format.