This documentation is archived and is not being maintained.

SqlDataSource.InsertParameters Property

Updated: February 2010

Gets the parameters collection that contains the parameters that are used by the InsertCommand property from the SqlDataSourceView object that is associated with the SqlDataSource control.

Namespace:  System.Web.UI.WebControls
Assembly:  System.Web (in System.Web.dll)

public ParameterCollection InsertParameters { get; }

Property Value

Type: System.Web.UI.WebControls.ParameterCollection
A ParameterCollection that contains the parameters used by the InsertCommand property.

The InsertParameters property retrieves the InsertParameters property that is contained by the SqlDataSourceView object that is associated with the SqlDataSource control.

If the InsertCommand property contains a parameterized SQL query, the InsertParameters collection contains any Parameter objects that correspond to the parameter placeholders in the SQL string.

Depending on the ADO.NET provider, the order of the parameters in the InsertParameters collection might be important. The System.Data.OleDb and System.Data.Odbc providers associate the parameters in the collection according to the order that the parameters appear in the parameterized SQL query. The System.Data.SqlClient provider, which is the default ADO.NET provider for the SqlDataSource control, associates the parameters in the collection by matching the name of the parameter with a placeholder alias in the SQL query. For more information about parameterized SQL queries and commands, see Using Parameters with the SqlDataSource Control.

Security noteSecurity Note:

Values are inserted into parameters without validation, which is a potential security threat. Use the Filtering event to validate parameter values before executing the query. For more information, see Script Exploits Overview.

The following code example demonstrates how to insert data into a database using the SqlDataSource control and a simple Web Forms page. The current data in the Data table is displayed in the DropDownList control. You can add new records by entering values in the TextBox controls, and then clicking the Insert button. When the Insert button is clicked, the specified values are inserted into the database, and the DropDownList control is refreshed.

Security noteSecurity Note:

This example includes a text box that accepts user input, which is a potential security threat, and values are inserted into parameters without validation, which is also a potential security threat. Use the Inserting event to validate parameter values before executing the query. For more information, see Script Exploits Overview.


This example shows how to use declarative syntax for data access. For information about how to access data by using code instead of markup, see Accessing Data (Visual Studio).

<%@Page  Language="C#" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "">

<script runat="server">
private void InsertShipper (object source, EventArgs e) {
<html xmlns="" >
  <head runat="server">
    <title>ASP.NET Example</title>
    <form id="form1" runat="server">
      Existing Shipping Companies<br />
        datavaluefield="ShipperID" />

<!-- Security Note: The SqlDataSource uses a FormParameter,
     Security Note: which does not perform validation of input from the client.
     Security Note: To validate the value of the FormParameter, handle the Inserting event. -->

        connectionstring="<%$ ConnectionStrings:MyNorthwind %>"
        selectcommand="SELECT CompanyName,ShipperID FROM Shippers"
        insertcommand="INSERT INTO Shippers (CompanyName,Phone) VALUES (@CoName,@Phone)">
            <asp:formparameter name="CoName" formfield="CompanyNameBox" />
            <asp:formparameter name="Phone"  formfield="PhoneBox" />

      <br />
      <br />
      Add new Company and Phone Number<br />

      Company Name
           runat="server" />

        ErrorMessage="Please enter a company name." />

      <br />
      Phone Number
           runat="server" />

        ErrorMessage="Please enter a phone number." />

      <br /><asp:button
           text="Insert New Shipper"
           onclick="InsertShipper" />


Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

.NET Framework

Supported in: 3.5, 3.0, 2.0




February 2010

Added link to information about programmatic data access.

Customer feedback.