Please see these threads for information on using parameters:
http://www.daniweb.com/forums/thread191241.html
http://www.daniweb.com/forums/thread198304.html
You should use parameterized queries. It makes your code easier to read, is less security risk, and has better performance:
private void simpleButton1_Click(object sender, EventArgs e)
{
const string query = "Insert Into aTable (aString, aDateTime) Values (@aString, @aDateTime)";
const string connStr = @"Data Source=apex2006sql;Initial Catalog=DB;Integrated Security=True;";
using (SqlConnection conn = new SqlConnection(connStr))
{
conn.Open();
using (SqlCommand cmd = new SqlCommand(query, conn))
{
string s1 = "abc123";
DateTime dtNow = DateTime.Now;
cmd.Parameters.Add(new SqlParameter(@"aString", SqlDbType.VarChar)).Value = s1;
cmd.Parameters.Add(new SqlParameter(@"aDateTime", SqlDbType.DateTime)).Value = dtNow;
cmd.ExecuteNonQuery();
}
conn.Close();
}
}
You're most likely using OleDb so switch the Sql* to OleDb* and it should suit your needs.