c# - SQLite table name from textbox value -


i want create table name in sqlite based on user inputted textbox value or declared string value. example:

cmd.commandtext = @"create table '"+machine_name.text+"' (date, cal_date) values (@date, @caldate)"; 

i'm receiving newline in constant error right before as. know may bad database design helpful me way.

the syntax create table following

cmd.commandtext = @"create table '" + newtable + "'" +                     "(date datetime, cal_date varchar(256))"; 

this of course assumes fields datetime , varchar.
in other words, after tablename put, between parenthesys, name of columns , datatype.

i suggest pay particular attention value user types name of new table. liberty type dangerous , basic building block when malicious user tries create sql injection attack.


Comments