c# - insert into statment error -

c# - insert into statment error -

i've been trying insert specific info database (in case microsoft access), next code wrote using c#:

string sql = "insert orders(user,pid,pname,price,amount)" + " values('" + od.user + "','" + od.pid + "','" + od.pname + "','" + od.price + "','" + od.amount + "')";

now assume form wrote fine , isnt it? error is:

syntax error in insert statement.

user reserved keyword. set brackets around specify want utilize identifier, not command:

string sql = "insert orders([user],pid,pname,price,amount)" + " values('" + od.user + "','" + od.pid + "','" + od.pname + "','" + od.price + "','" + od.amount + "')";

this should solve immediate problem. using parameterised query (as several has suggested) avoid future problems also.

c# asp.net sql ms-access