Issue executing query

[Daniel DAngelo]

So I have this app I'm building (I'm new to C#) and through countless hours i have managed to come up with the following so far on button click event.

I have a text box, dropdown, and a radio button. I want to insert all these values in to a table. the only catch is that the Dropdown value must be used to first cross reference the users table and pull the users UserId and use that value for the INSERT statement. Now heres the code behind...

protected void btnSubmit_Click (object sender, EventArgs e)
{
SqlConnection ConnectionInfo = new SqlConnection() ;
ConnectionInfo. ConnectionStrin g = ConfigurationMa nager.Connectio nStrings["ApplicationSer vices"].ConnectionStri ng;
SqlCommand cmd = new SqlCommand();


if (rbDisabled.Che cked)
rbResults.Text = rbDisabled.Text ;
if (rbEnabled.Chec ked)
rbResults.Text = rbEnabled.Text;

string AccountName = AccountName1.Te xt;
string OwnerName = AllUsersDropDow nList1.Selected Value;
string Status = rbResults.Text;

cmd.CommandText = "SELECT (UserId) FROM (dbo.aspnet_Use rs) WHERE UserName = " + AllUsersDropDow nList1.Selected Value + ";";
cmd.CommandType = CommandType.Tex t;

cmd.Connection = ConnectionInfo;

ConnectionInfo. Open();

SqlDataReader reader = cmd.ExecuteRead er();
var con = reader.Read();

SqlCommand cmd1 = new SqlCommand();


cmd1.CommandTex t = "INSERT INTO (dbo.apt_accoun ts) (account_owner_ id, account_name, account_active) VALUES ('" + con + ", " + AccountName + ", " + Status + "')";
cmd1.CommandTyp e = CommandType.Tex t;
cmd1.Connection = ConnectionInfo;

cmd1.ExecuteRea der();


}


}

Problem is I am getting:
Exception Details: System.Data.Sql Client.SqlExcep tion: Incorrect syntax near ')'.

Line 40: ConnectionInfo. Open();
Line 41:
Line 42: SqlDataReader reader = cmd.ExecuteRead er();
Line 43: var con = reader.Read();
Line 44:

Any help to the right direction would be great appreciated. If you need any more info please ask.

[Rabbit]

Get rid of the parentheses in the SQL string.

[Sivaranjani]

I am ran in Your code. I am not getting the error.Please Check, you put extra ')' closing parenthese in your Coading.

[Brian Connelly]

Look at the underlined characters...th ats where it is resulting in an error. Hope this helps.
cmd1.CommandTex t = "INSERT INTO (dbo.apt_accoun ts) (account_owner_ id, account_name, account_active) VALUES ('" + con + ", " + AccountName + ", " + Status + "')";

[Daniel DAngelo]

I found the issue was i didn't space out the ):

"INSERT INTO dbo.apt_account s ( account_owner_i d, account_name, account_active ) VALUES ( '" + reader + "', '" + AccountName + "', '" + Status + "' )";

Worked Fine

[Daniel DAngelo]

and got rid of the ) around collum, DB Thanks Rabbit

[PsychoCoder]

Try this version of your code

cmd1.CommandText = "INSERT INTO (dbo.apt_accounts) (account_owner_id, account_name, account_active) VALUES ('" + con + "'", "'" + AccountName + "'", "'" + Status + "')";

[PsychoCoder]

You should be using parameterized queries, your current code is just waiting for a SQL Injection attack. Take a look at this:

Parameterized queries: The hows and whys | http://bit.ly/t2hohD