Avoiding SQL Injection[^] isn't hard:
string save = "Insert into ShippingCompany ([ShippingCompanyCode], [ShippingCompanyName], [CurenccyCode], [ActiveStatus], [CreateBy], [CreateDate], [modifiedBy], [modifiedDate]) "
+ "values (@ShippingCompanyCode, @ShippingCompanyName, @CurenccyCode, @ActiveStatus, @CreateBy, @CreateDate, @modifiedBy, @modifiedDate)";
using (SqlConnection con = new SqlConnection(dikonek))
using (SqlCommand cmd = new SqlCommand(save, con))
{
cmd.Parameters.AddWithValue("@ShippingCompanyCode", t1.Text);
cmd.Parameters.AddWithValue("@ShippingCompanyName", t2.Text);
cmd.Parameters.AddWithValue("@CurenccyCode", t3.Text);
cmd.Parameters.AddWithValue("@ActiveStatus", t4.Text);
cmd.Parameters.AddWithValue("@CreateBy", t5.Text);
cmd.Parameters.AddWithValue("@CreateDate", DateTime.Now);
cmd.Parameters.AddWithValue("@modifiedBy", t7.Text);
cmd.Parameters.AddWithValue("@modifiedDate", DateTime.Now);
con.Open();
int rowsAffected = cmd.ExecuteNonQuery();
MessageBox.Show(string.Format("{0} rows affected.", rowsAffected));
}
You should also consider giving your controls more meaningful names than t1, t2, etc.
"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer
