quote:

---

Originally posted by tech_1

firstly, you should be using parameterised SQL to avoid injection attacks etc... - this is best practice and easier to trace your parameters too.

secondly, your table name contains a space - really, they shouldn't. you should perhaps place the square brackets around it:

INSERT INTO [My Checking]

with your code:

"INSERT INTO [" + Name + "]} ....

---

 GetLastId(Name);
 newId = lastId + 1;
 string cknr = "";
 string pmt = "";
 string c = "";
 string parm = "[" +Name+"]";
 string payee = "Opening Balance"; ;
 string dep = bal;
 //bal = need to get a search for provious balance then this becomes 'prevbal + dep - pmt'
 bal = "0"; 

 string connetionString = "Data Source=(LocalDB)\\v11.0;AttachDbFilename=|DataDirectory|" +
 "\\Checkbook.mdf;Integrated Security=True;Connect Timeout=30";
 

 string sqlStmt = "INSERT INTO " + parm + " (Id, Date, CheckNr, Payee, Category, Payment, Clr, Deposit, Balance) values (@p1, @p2, @p3, @p4, @p5, @p6, @p7, @p8, @p9)";

 using (SqlCommand command = new SqlCommand(sqlStmt, new SqlConnection(connectionString)))
 {
    command.Parameters.Add(new SqlParameter("@p1", newId));
    command.Parameters.Add(new SqlParameter("@p2", open));
    command.Parameters.Add(new SqlParameter("@p3", cknr));
    command.Parameters.Add(new SqlParameter("@p4", payee));
    command.Parameters.Add(new SqlParameter("@p5", parm));
    command.Parameters.Add(new SqlParameter("@p6", pmt));
    command.Parameters.Add(new SqlParameter("@p7", c));
    command.Parameters.Add(new SqlParameter("@p8", dep));
    command.Parameters.Add(new SqlParameter("@p9", bal));
 

    try
    {
       command.Connection.Open()
       command.ExecuteNonQuery();
    }
    catch (Exception ex)
    {
       MessageBox.Show(ex.ToString());
    }
    finally
    {
       if (command.Connection.State == ConnectionState.Open)
       {
          command.Connection.Close();
       }
    }
 }