Saving to database from VB.NET WinForms - sql-server

Question

How can you add data in a window form to a sql database in visual studio 2005?
I'm facing problems while saving.
Public Class Staff
Dim myconnection As SqlConnection
Dim mycommand As SqlCommand
Dim dr As SqlDataReader
Dim dr1 As SqlDataReader
Dim ra As Integer
Private Sub cmdsave_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdsave.Click
myconnection = New SqlConnection("server=localhost;uid=sa;pwd=;database=medisam")
myconnection.Open()
mycommand = New SqlCommand("insert into staff([FirstName],[LastName],[Address],[DOB], [TelephoneNum], [DateJoinIn], [HighestQualifi], [AppointedAs], [Salary]) VALUES ('" & txtfname.Text & "','" & txtlname.Text & "','" & txtaddress.Text & "','" & txtdob.Text & "','" & txttelephone.Text & "','" & txthqualifi.Text & "','" & ComboBox1.SelectedValue & "','" & txtsalary.Text & "')", myconnection)
mycommand.ExecuteNonQuery()
myconnection.Close()
End Sub
End Class

Answer 1

Well, at first glance, I can see a missing value in your query text:
I can count 9 fields and only 8 values... but this could be only an typing error.
More serious instead is the lack of parameter use. As #slaks pointed in its comment, this kind of code leads to Sql Injection Attacks. Also, you are passing all values as strings. I doubt that your [staff] table contains only text fields (DOB, DateJoinIn, AppointedAs). If it does, your schema design is horribly broken. The parameters could also help avoid this kind of error. Finally, connecting with the sa account will cause your dba to hunt you down and beat you to within an inch of your life.
Please rewrite your method in this way:
Private Sub cmdsave_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdsave.Click
Using (myconnection as SqlConnection = New SqlConnection("server=localhost;uid=sa;pwd=;database=medisam"))
myconnection.Open()
mycommand = New SqlCommand("insert into staff([FirstName],[LastName],[Address],[DOB], " & _
"[TelephoneNum], [DateJoinIn], [HighestQualifi], [AppointedAs], [Salary]) " & _
"VALUES (#first, #last, #address, #dob, #tel, #dateJ, #highQ, #appointed, #sal)", myconnection)
mycommand.Parameters.AddWithValue("#first", txtfname.Text)
mycommand.Parameters.AddWithValue("#last", txtlname.Text)
mycommand.Parameters.AddWithValue("#address", txtaddress.Text)
mycommand.Parameters.AddWithValue("#dob",txtdob.Text) ' if this is a date, need to convert
mycommand.Parameters.AddWithValue("#tel",txttelephone.Text)
mycommand.Parameters.AddWithValue("#dateJ", txt??? Missing ????)
mycommand.Parameters.AddWithValue("#highQ",txthqualifi.Text)
mycommand.Parameters.AddWithValue("#appointed",ComboBox1.SelectedValue) ' need to convert ???
mycommand.Parameters.AddWithValue("#sal",txtsalary.Text) ' need to convert ???
mycommand.ExecuteNonQuery()
End Using
End Sub