It says Incorrect syntax near ',' when I try to insert an item into my database? - sql

Question

Code :
Private m_cn As New SqlConnection
Private m_DA As SqlDataAdapter
Private m_CB As SqlCommandBuilder
Private m_DataTable As New DataTable
Private m_intRowPosition As Integer = 0
Private Sub InsertDatabaseItem_Load(sender As Object, e As EventArgs) Handles MyBase.Load
m_cn.ConnectionString = "Data Source=My-PC\SQLSERVEREXPRESS;Initial Catalog=ConvienienceProducts;Integrated Security=True"
m_cn.Open()
m_DA = New SqlDataAdapter("Select * From ProductIndex", m_cn)
m_CB = New SqlCommandBuilder(m_DA)
End Sub
Private Sub btnOK_Click(sender As Object, e As EventArgs) Handles btnOK.Click
Dim cmd As New SqlCommand(("INSERT INTO ProductIndex VALUES(" &
txtID.Text & "," &
txtName.Text & "," &
txtPrice.Text & "," &
txtDesc.Text & ")"), m_cn)
cmd.ExecuteNonQuery()
MsgBox("Success....", MsgBoxStyle.Information, "SUCCESS")
Me.Hide()
txtID.Clear()
txtName.Clear()
txtPrice.Clear()
txtDesc.Clear()
m_cn.Close()
m_cn.Dispose()
End Sub
Private Sub btnCancel_Click(sender As Object, e As EventArgs) Handles btnCancel.Click
Me.Hide()
End Sub
This is the error message :
An unhandled exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll
Additional information: Incorrect syntax near ','.

Answer 1

You code should be using parameters. Try this:
Dim cmd As New SqlCommand(("INSERT INTO ProductIndex VALUES(" &
"#ID," &
"#Name," &
"#Price," &
"#Desc)"), m_cn)
cmd.Parameters.Add("#ID", SqlDbType.Char)
cmd.Parameters("#ID").Value = txtID.Text
cmd.Parameters.Add("#Name", SqlDbType.Char)
cmd.Parameters("#Name").Value = txtName.Text
cmd.Parameters.Add("#Price", SqlDbType.Char)
cmd.Parameters("#Price").Value = txtPrice.Text
cmd.Parameters.Add("#Desc", SqlDbType.Char)
cmd.Parameters("#Desc").Value = txtDesc.Text
The types are probably wrong (especially Price, and probably ID), but as you know what they are, and I don't, you can easily correct them.

Answer 2

You need to wrap your string values in single quotes
Dim cmd As New SqlCommand(("INSERT INTO ProductIndex VALUES('" & txtID.Text & "',
Hard to see but there is a single quote just before and after the double quotes surrounding your variables.
I have answered your particular question but you should be using parameters