System.Data.SqlClient.SqlException: incorrect syntax near " abc ".

Question

here is my code please give me suggestion what to do next

error line is ==> "@usercountry"

its telling incorrect syntax near "@usercountry"

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Data.SqlClient;
using signup_login.DatabaseProject;

namespace signup_login
{

    public partial class SignUp : Form
    {
        DBAccess access = new DBAccess();
        public SignUp()
        {
            InitializeComponent();
        }

        private void btnsignup_Click(object sender, EventArgs e)
        {
            String username = txtname.Text;
            String useremail = txtmail.Text;
            String userpassword = txtpassword.Text;
            String usercountry = cbcountry.Text;
            if (username.Equals(""))
            {
                MessageBox.Show("pls enter your name.", "WARNING", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
            else if (useremail.Equals(""))
            {
                MessageBox.Show("pls enter your mail.", "WARNING", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
            else if (userpassword.Equals(""))
            {
                MessageBox.Show("pls enter your password.", "WARNING", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
            else if (usercountry.Equals(""))
            {
                MessageBox.Show("pls select your country.", "WARNING", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
            else
            {
                SqlCommand insertcommand = new SqlCommand("INSERT INTO dbo.users(NAME, EMAIL, PASSWORD, COUNTRY) VALUES (@username , @useremail , @userpassword , @usercountry");

                //BELOW LINES ARE TO SECURE THE DATA FORM THIRD PARTY APPS 

                insertcommand.Parameters.AddWithValue("@username", username);
                insertcommand.Parameters.AddWithValue("@useremail", useremail);
                insertcommand.Parameters.AddWithValue("@userpassword", userpassword);
                insertcommand.Parameters.AddWithValue("@usercountry", usercountry);
                if (access.executeQuery(insertcommand) == 1)
                {
                    MessageBox.Show("the signup is successfully done", "CONFORMATION", MessageBoxButtons.OK, MessageBoxIcon.Information);
                    this.Hide();
                    Homepage home = new Homepage();
                    home.Show();
                }
                else
                {
                    MessageBox.Show("signup faild please try again", "WARNING", MessageBoxButtons.OK, MessageBoxIcon.Error);
                }
            }
        }
    }
}

Answer 1

The issue with your code is that you are missing a closing parenthesis in your SQL INSERT statement. The correct statement should be:

SqlCommand insertcommand = new SqlCommand("INSERT INTO dbo.users(NAME, EMAIL, PASSWORD, COUNTRY) VALUES (@username , @useremail , @userpassword , @usercountry)");

Notice the closing parenthesis at the end of the statement.

References:

• Introducing ASP.NET Web Pages - Entering Database Data by Using Forms