c# - Multiple Insert statements in one connection -


i need tips on how better, inserting multiple queries using 1 connection.

i understand not programming, being prone sql injection, wanted mention it's not going out on internet run locally.

this have far..

public partial class modify : system.web.ui.page {     oledbconnection connection;     oledbcommand command;    public void openconnection2()     {         connection = new oledbconnection("");         command = new oledbcommand();         connection.open();     }    protected void btnsave_click1(object sender, eventargs e)     {         if (acctnumlist.selectedvalue == "3")         {             string query2 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name1txtbox.text.replace("'", "''"), amt1txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             string query3 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name2txtbox.text.replace("'", "''"), amt2txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             string query4 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name3txtbox.text.replace("'", "''"), amt3txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             openconnection2();             command.connection = connection;             command.commandtext = query2;             int c = command.executenonquery();             connection.close();         }      if (acctnumlist.selectedvalue == "4")         {             string query2 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name1txtbox.text.replace("'", "''"), amt1txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             string query3 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name2txtbox.text.replace("'", "''"), amt2txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             string query4 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name3txtbox.text.replace("'", "''"), amt3txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             string query5 = string.format(@"insert ach (rptid, tableid, name, amount, stat, create_date) values                                                              ('{0}','{1}','{2}','{3}','{4}','{5}')",                                                             id, newguid, name4txtbox.text.replace("'", "''"), amt4txtbox.text.replace("'", "''"), 3, datetime.now.tostring());             openconnection2();             command.connection = connection;             command.commandtext = query2;             int c = command.executenonquery();             connection.close();         } 

you should parameterized query - always, can concatenate queries ; , execute them once like:

string allqueries = string.join(';', query2, query3, query4, query5); command.commandtext = allqueries;  int c = command.executenonquery(); 

currently executing 1 query. semicolon ; marks end of statement in sql, combining these statements ; make them separate statements executed under 1 execution.

kcray - worked me.

 string[] arr = { query2, query3 };  string allqueries = string.join(";", arr);  command.commandtext = allqueries;  int c = command.executenonquery(); 

Comments

Popular posts from this blog

curl - PHP fsockopen help required -

HTTP/1.0 407 Proxy Authentication Required PHP -

c# - Resource not found error -