Getting Error at insert on Visual Basic .Net - vb.net

Question

im trying to make an insert to my Database and im receiving an error, is my first time with VB.Net so any help would be greatly appreciated.
Here is the code:
Sub InsertGestion(ByVal s As Object, ByVal e As EventArgs)
Dim Records() As String
Records = Split(TBComment.Text, vbCrLf)
Dim record As Integer
For record = 0 To UBound(Records)
oracleCommand = New OracleCommand("INSERT INTO ACTFIL (ACACCTG,ACACCT,ACACTDTE,ACSEQNUM,ACACCODE,ACRCCODE,ACCIDNAM,ACCOMM) values ('1','" + TBNum.text + "','" + TBFecha.Text + "',"+ (record+1) +",'"+TBCodAc.text+"','"+TBCodRes.text+"','"+TBGestor.Text+"','"+record+"')", oracleConexion)
Try
oracleConexion.Open()
oracleCommand.ExecuteNonQuery()
Catch ex As Exception
status.Text = "ERROR al insertar la gestión " + ex.Message + "'" '& ex.Message
Finally
oracleConexion.Close()
Response.Redirect("gestiones.aspx?credito=" + Request.QueryString("credito") + "")
End Try
Next
End Sub
And the Error:
FormatException: Input string was not in a correct format.]
Microsoft.VisualBasic.CompilerServices.Conversions.ParseDouble(String Value, NumberFormatInfo NumberFormat) +717374
Microsoft.VisualBasic.CompilerServices.Conversions.ToDouble(String Value, NumberFormatInfo NumberFormat) +114
[InvalidCastException: Conversion from string "INSERT INTO ACTFIL (ACACCTG,ACAC" to type 'Double' is not valid.]
Microsoft.VisualBasic.CompilerServices.Conversions.ToDouble(String Value, NumberFormatInfo NumberFormat) +717687
ASP.marcador_gestiones_aspx.InsertGestion(Object s, EventArgs e) in G:\vta-paqV2\marcador\gestiones.aspx:62
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +115
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +140
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +29
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2981
This was originally an update and it was working, i just modified the OracleCommand.
Btw, i notice this is not a secure way to execute the queries, if someone can point me on the right direction i'd really appreciate it.

Answer 1

Extract the oracle command from the query and run on Oracle client. That will let you know if there is anything wrong with your oracle command.
Secondly you can use string.format to form your query rather using + operator.
Secure approach to deal with query inputs is through input parameters. You can check below links.
http://msdn.microsoft.com/en-us/library/system.data.oracleclient.oracleparameter.aspx
http://blogs.msdn.com/b/alextch/archive/2007/08/21/using-data-parameters-with-oracle-data-provider-for-net.aspx
I hope this helps.
Thanks!
Dhananjay