title: MySQL insert command using prepared statement and placeholders is not working
body: <p>I built a MySql database and a C# Windows GUI form to with textbox fields and a timedate picker to populate a table named 'job' in my database.</p>
  
  <p>I have read a few posts on this site about the importance of using prepared statements to prevent sql injection attacks and I tried to use this security feature in my code.
  However it is not working. I am a web designer but very new to programming. I tried different code variations at the insert command still won't work. The samples I have found on this form involve using prepared statements with PHP, which is not what I am using.</p>
  
  <p>I get the following error message: You have an error in your SQL syntax; check the manual or your MySQL server version for the right syntax to use near 'jobTitle, this.dateTimePickerJobLastUpdated')' at line 1</p>
  
  <p>Does anyone know what I am doing wrong and how I can fix this?</p>
  
  <p>This is the MySQL statement for the table.</p>
  
  <p>CREATE TABLE job (</p>
  
  <pre><code>job_code VARCHAR(6) NOT NULL DEFAULT '',
  job_title VARCHAR(30) NOT NULL DEFAULT '',  
      job_last_update DATE NOT NULL, 
      PRIMARY KEY (job_code)
  </code></pre>
  
  <p>)ENGINE=InnoDB CHARSET=utf8;</p>
  
  <p>And this is my C# for the event handler that will save the data entry from the windows form to the database.</p>
  
  <p>private void btnSaveJobsTable_Click(object sender, EventArgs e)
          {</p>
  
  <pre><code>        String myConnection = @"server=localhost; database=beautyshopdb; username=$$$$; password=$$$$$$";
          MySqlConnection Connect = null;
          try
          {
              Connect = new MySqlConnection(myConnection);
              Connect.Open(); //open the connection
              //This is the mysql command that we will query into the db.
              //It uses Prepared statements and the Placeholder is @name.
              //Using prepared statements is faster and secure.
              String insertQuery = "INSERT INTO beautyshopdb(job) VALUES(@jobCode, @)jobTitle, @lastUpdated)";
              MySqlCommand cmdInsertJobsToDataBase = new MySqlCommand(insertQuery, Connect);
              cmdInsertJobsToDataBase.Prepare();
              //we will bound a value to the placeholder
              cmdInsertJobsToDataBase.Parameters.AddWithValue("@jobCode", "this.txtEnterJobCode.Text");
              cmdInsertJobsToDataBase.Parameters.AddWithValue("@jobTitle", "this.txtEnterJobTitle.Text");
              cmdInsertJobsToDataBase.Parameters.AddWithValue("@lastUpdated", "this.dateTimePickerJobLastUpdated");
              cmdInsertJobsToDataBase.ExecuteNonQuery(); //execute the mysql command
          }
          catch (Exception ex)
          {
              MessageBox.Show(ex.Message);
          }
          finally
          {
              if (Connect != null)
              {
                  Connect.Close(); //close the connection
              }
          }
  </code></pre>
  
  <p>}</p>
  
  <p>Thank you!</p>