Error : To few parameters in insert into statement

[codruta1990]

Hy

I need some help with my insert into sql command:
I want to insert into a database(Access) some values taken from some textboxes.

My code is the folowing:

procedure Tfrm_AdaugareClienti.Button1Click(Sender: TObject);
var s:string;
begin
s:='Insert into Clienti values('+ Edit1.Text + ',"'+ Edit2.Text + '","' + Combobox1.Text+'","' + Edit3.Text + '","' + Edit4.Text + '","' + Edit5.Text + '","' + Edit6.Text + '","' + Edit7.Text + '","' + Edit8.Text + '","' + Edit9.Text + '","' + Edit10.Text + '")';

showmessage(s);
Adoquery1.SQL.clear;
Adoquery1.SQL.Add(s);
Adoquery1.ExecSQL ;


I just can't understand what's the problem...My database has 11 fields, the firs one is number and the other ones are text...

Codruta

 

[whosrdaddy]

first of all:

don't create your queries this way.
This is the most insecure way and you are vulnerable to SQL injection. Ask Sony if you don't believe me

now your SQL statement:
I always specify columns for the insers statement.
This make your code more readable and understandable.

 s := 'INSERT INTO Client (col1,col2) VALUES (:value1, :value2)';

rinse and repeat for your 11 columns.
Look here how to use parameters with TADOQuery:
thread102-1647044

Cheers,
Daddy





-----------------------------------------------------
What You See Is What You Get
Never underestimate tha powah of tha google!

 

[DjangMan]

I recommend going one step further and using Daddy's IIADOQuery object:

http://www.tek-tips.com/viewthread.cfm?qid=1647984

 

[codruta1990]

It worked. Thanks