Tevin says:
sSQL.Append(vbCrLf & " , '" & document.ToString() & "'")
You can't concatenate an array. So the best practice is using parameterized queries.
Check this example. Now please take its reference and correct your code.
HTML
<asp:FileUpload ID="FileUpload1" runat="server" />
<asp:Button Text="Insert" runat="server" OnClick="Insert" />
Code
Protected Sub Insert(sender As Object, e As System.EventArgs)
Dim filename As String = Path.GetFileName(FileUpload1.PostedFile.FileName)
Dim contentType As String = FileUpload1.PostedFile.ContentType
Dim fs As Stream = FileUpload1.PostedFile.InputStream
Dim br As New BinaryReader(fs)
Dim bytes As Byte() = br.ReadBytes(CType(fs.Length, Integer))
Try
Dim mLMS As aplLumotechMedicalSurveillance = New aplLumotechMedicalSurveillance()
mLMS.InsertMedicalResults(filename, contentType, bytes)
Catch ex As Exception
Throw ex
End Try
End Sub
aplLumotechMedicalSurveillance
Public Function InsertMedicalResults(ByVal documentName As String, ByVal documentType As String, ByVal document As Byte()) As Integer
Try
Dim m_oLMS As dalLumotechMedicalSurveillance = New dalLumotechMedicalSurveillance()
Return m_oLMS.InsertMedicalResults(documentName, documentType, document)
Catch ex As Exception
Throw ex
Finally
End Try
End Function
dalLumotechMedicalSurveillance
Public Function InsertMedicalResults(ByVal documentName As String, ByVal documentType As String, ByVal document As Byte()) As Integer
Dim sSQL As New System.Text.StringBuilder
Try
Dim conn As SqlConnection = New SqlConnection(ConfigurationManager.ConnectionStrings("constr").ConnectionString)
Dim sql As String = "INSERT INTO tblFiles (Name,ContentType,Data) VALUES(@Name, @ContentType, @Data)"
Dim cmd As SqlCommand = New SqlCommand(sql, conn)
cmd.Parameters.AddWithValue("@Name", documentName)
cmd.Parameters.AddWithValue("@ContentType", documentType)
cmd.Parameters.AddWithValue("@Data", document)
conn.Open()
Return cmd.ExecuteNonQuery()
conn.Close()
Catch ex As Exception
Throw ex
Finally
sSQL = Nothing
End Try
End Function
