sql insert double to database

In my vb.net code, I had the following code:

Code:

---


 sql = "INSERT INTO Trn_BranchReportTop ([SellerID],[BranchGLN],[BranchName],[Total]) VALUES('" + Session.Item("UserCompanyID") + "','" + BranchGLN + "','" + Name + "','" + dsPOTrailers.Tables(0).Rows(0).Item("Cost").ToString() + "' )) "
                    objDB.ExecuteNonQuery(sql)

---

How should I change so that the dsPOTrailers.Tables(0).Rows(0).Item("Cost").ToString() can be insert to the database which is double datatype in the database.

Try something like:

Code:

---

sql = "INSERT INTO Trn_BranchReportTop ([SellerID],[BranchGLN],[BranchName],[Total]) VALUES('" + Session.Item("UserCompanyID") + "','" + BranchGLN + "','" + Name + "','" + CType(dsPOTrailers.Tables(0).Rows(0).Item("Cost").ToString(),Double) + "' )) "

---

CType will convert data types. I think this should work for you.

You should always use STORED PROCEDURES to interact with the DB. If you have to use a query, make sure that it's a PARAMETERIZED QUERY, to prevent SQL INJECTION