'I am getting 'System.Web.UI.WebControls.TextBox' into sql table instead of getting actual data entered in text boxes

Can someone please help me figure out why I am getting 'System.Web.UI.WebControls.TextBox' in MySQL database instead of actual values being entered in the text field. The code I am using is below ..

MySql.Data.MySqlClient.MySqlConnection conn;
MySql.Data.MySqlClient.MySqlCommand cmd;
string queryStr;
string connString=System.Configuration.ConfigurationManager.ConnectionStrings["WebAppConnectionString"].ToString();
conn = new MySql.Data.MySqlClient.MySqlConnection(connString);
conn.Open();
queryStr = "";
queryStr = "INSERT INTO seework.userdata (First_Name, Middle_Name, Last_Name, Email_Address, Phone_Number, Username, Password)" + "VALUES('" + firstnameTextBox + "','" + middlenameTextBox + "','" + lastnameTextBox + "','" + emailaddressTextBox + "','" + phonenoTextBox + "','" + usernameTextBox + "','" + passwordTextBox + "')";
cmd = new MySql.Data.MySqlClient.MySqlCommand(queryStr, conn);
cmd.ExecuteReader();
conn.Close();

I have tried all I could but still no luck. Any help would be really appreciated. Thanks in Advance!

c++sharpmysql


Solution 1:[1]

You are passing the TextBox itself to the database using the query. You need to pass the text instead. For this you can use .Text property of the TextBox control. Which gives you the Text/Content inside the Textbox Control. And one more advise for you. Use Parameterized queries instead for cuch queries to avoid Sql Injection.

For example:

queryStr = "INSERT INTO seework.userdata (First_Name, Middle_Name)VALUES(@fName,@mName)";
SqlCommand cmd = new SqlCommand(queryStr);
cmd.Parameters.Add("@fName",SqlDbType.VarChar).Value=firstnameTextBox.Text ;
cmd.Parameters.Add("@mName",SqlDbType.VarChar).Value=middlenameTextBox.Text; 
// Build your command like this
// Execute the command then

Solution 2:[2]

you should use .Text after the name of TEXTBOX. For Example :-

string insert = "insert into table_Name (Name, Contact, Email) values ('" + txtname.Text + "', '" + txtcontact.Text + "', '" + txtemail.Text + "')";

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 sujith karivelil
Solution 2 Suraj Rao

Related Questions