rrrriiizz wrote:
str = "Insert into EmployeeMaster values('" & txtname.Text & "','" & txtfname.Text & "','" & dtdob.Text & "','" & gencom.Text & "','" & txtqual.Text & " ','" & txtbg.Text & " ','" & martcom.Text & "','" & txtadd.Text & "',' " & txtcadd.Text & " ','" & txtpho.Text & "','" & txtmob.Text & "',' " & txtemail.Text & " ','" & txtpp.Text & " ','" & txtpv.Text & " ',' " & txteno.Text & " ',' " & depcom.Text & " ', ' " & descom.Text & " ',' " & dtdoj.Text & " ','" & catcom.Text & "','" & mopcom.Text & "','" & txtac.Text & "','" & byes.Text & "',' " & txtbv.Text & "',' " & txtcdue.Text & "','" & txtcdate.Text & "','" & txtesino.Text & "','" & txtpfno.Text & "','" & expyes.Text & "',' " & detcom.Text & "','" & txtpc.Text & "','" & txtnc.Text & "' )"
This is begging for a SQL attack, you should use parameterised queries, or, better yet, stored procs. Colin has an excellent article on SQL injection, you should read it. In C#, you can do this: string sex = (rdoMale.Checked) ? "Male" : "Female"; Does VB do something like that ? Basically, it depends on how your data is stored, if it's a bool use the check result of the appropriate button. Otherwise, you need to build your paramater based on radio button state.
Christian Graus - Microsoft MVP - C++ Metal Musings - Rex and my new metal blog "I am working on a project that will convert a FORTRAN code to corresponding C++ code.I am not aware of FORTRAN syntax" ( spotted in the C++/CLI forum )