problem in inserting to the database (-1 inserted)

[Yahya]

hello there
am making an online exam page using ASP.net a part from a big project, what am facing that when am trying to insert what the student answered i receive no result, i used the execute none query to see if something changed, but i receive -1 inserted !!!

here is the program

Protected Sub Button6_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button6.Click
           
           
       

            Dim ssql As String = "SELECT CorrectChoice FROM Question WHERE QId='" & TextBox8.Text & "'"
            Dim conn As New SqlConnection("Data Source=(local);Initial Catalog=Exam;Integrated Security=True")
            Dim cmdd As New SqlCommand(ssql, conn)
            Dim added As Integer = 0
            Dim readerr As SqlDataReader
            Try
                conn.Open()
                added = cmdd.ExecuteNonQuery()
                Label1.Text = added.ToString() & " ANSWER inserted."
                
                
                
                
                
                readerr = cmdd.ExecuteReader()
                      
            
                readerr.Read()
                Dim insertsql As String
        
            
            
                insertsql = "Insert into Student_Quest("
                insertsql &= "StId,QId,ChosenAnswer,IsCorrect)"
                insertsql &= "values('"
        
                insertsql &= TextBox7.Text & "','"
           
                insertsql &= TextBox8.Text & "','"
     
               
                If RadioButton1.Checked = True Then
                    insertsql &= TextBox2.Text & "','"
                    If (TextBox2.Text = readerr("CorrectChoice").ToString()) Then
                        insertsql &= "True" & "')"
                    Else
                        insertsql &= "False " & "')"
                    End If
                
                End If
                If RadioButton2.Checked = True Then
                    insertsql &= TextBox3.Text & "','"
                    If (TextBox3.Text = readerr("CorrectChoice").ToString()) Then
                        insertsql &= "True" & "')"
                    Else
                        insertsql &= "False" & "')"
                    End If
                End If
                If RadioButton3.Checked = True Then
                    insertsql &= TextBox4.Text & "','"
                    If (TextBox4.Text = readerr("CorrectChoice").ToString()) Then
                        insertsql &= "True" & "')"
                    Else
                        insertsql &= "False" & "')"
                    End If
                
                
                End If
                If RadioButton4.Checked = True Then
                    insertsql &= TextBox5.Text & "','"
                    If (TextBox5.Text = readerr("CorrectChoice").ToString()) Then
                        insertsql &= "True" & "')"
                    Else
                        insertsql &= "False" & "')"
                    End If
                End If
                If RadioButton5.Checked = True Then
                    insertsql &= TextBox6.Text & "','"
                
                    If (TextBox6.Text = readerr("CorrectChoice").ToString()) Then
                        insertsql &= "True" & "')"
                    Else
                        insertsql &= "False" & "')"
                    End If
                End If
           
            readerr.Close()
            Catch err As Exception
                Label1.Text = "Error reading list ."
                Label1.Text &= err.Message
            Finally
               
                conn.Close()
            End Try
            
          
          
     

        End Sub

and here is the pic.



any idea ?

 

[InertiaM]

Yup, loads of ideas

1. Use parameters instead of building SQL strings. See the link in my signature.

2. Where do you actually execute the insertsql query???

 

[Yahya]

Yup, loads of ideas

1. Use parameters instead of building SQL strings. See the link in my signature.

2. Where do you actually execute the insertsql query???

1. am reading the article
2. sorry ,i didn't understand the question

 

[InertiaM]

2. sorry ,i didn't understand the question

The question doesnt take much understanding. I suppose I could have worded it slightly differently, for example "where are you executing the SQL to insert the record?", but I cant imagine it would have helped.

You run ExecuteNonQuery (with no SQL) - then you build the SQL for the query, and never actually execute it.

Look at this line :-

added = cmdd.ExecuteNonQuery()

What do you actually think it's doing? I dont mean - what SHOULD it be doing? I mean what it is ACTUALLY doing, at the location that you have coded it at?