command.ExecuteNonQuery() - Incorrect syntax near ',' [duplicate] - sql

Question

This question already has answers here:
What are good ways to prevent SQL injection? [duplicate]
(4 answers)
Closed 2 years ago.
I'm trying to create a Windows form that inserts data into my database when I type into it and click submit. It works for short things, but when I tried to type some longer sentences, it says this:
And here's the code:
private void SubmitButton_Click(object sender, EventArgs e)
{
con.Open();
cmd = new SqlCommand("INSERT INTO Jokes VALUES('" + EnterJoke.Text + "', '" + EnterAnswer.Text + "')", con);
cmd.ExecuteNonQuery();
MessageBox.Show(" Data Has Been Saved In Database ");
con.Close();
}
I get the error on this line:
cmd.ExecuteNonQuery();

Answer 1

Input text must be having a special character punctuation that is not being taken as part of the literal text as your code is doing a plain concatenation.
Try the below code that fixes two issues:
Most importantly, the SQL injection vulnerability.
Secondly, your issue (if it is something related to the input string having special characters)
private void SubmitButton_Click(object sender, EventArgs e)
{
SqlParameter joke = new SqlParameter();
joke.ParameterName = "#joke";
joke.SqlDbType = SqlDbType.VarChar;
joke.Value = EnterJoke.Text;
SqlParameter answer = new SqlParameter();
answer.ParameterName = "#answer";
answer.SqlDbType = SqlDbType.VarChar;
answer.Value = EnterAnswer.Text;
cmd = new SqlCommand("INSERT INTO Jokes VALUES(#joke, #answer)", con);
cmd.Parameters.Add(joke);
cmd.Parameters.Add(answer);
con.Open();
cmd.ExecuteNonQuery();
MessageBox.Show(" Data Has Been Saved In Database ");
con.Close();
}