title: C# SQL Insert with a very large number of parameters
body: <p>I have had a problem for a few days and nothing online seems to do it.</p>
  
  <p>I have an SQL table that has 150 columns. I am reading data from an ODBC connection and I want to insert that data into the SQL table. Basically duplicate the ODBC table as SQL.</p>
  
  <p>My problem is that if I put everything in a string and insert it I face a hell of a time with escape characters and exceptions that I can't figure out. </p>
  
  <p>Is there a way to parametrize my insert values that doesn't involve me naming each and every on of them separatly.</p>
  
  <p>This is what I have right now. Also, if anyone knows an easier way to move an ODBC table to an SQL form please let me know</p>
  
  <pre><code>private void fillTable(string tableName)
      {
  
          String query = "SELECT * FROM " + tableName;
          OdbcCommand command = new OdbcCommand(query, Program.myConnection);
          OdbcDataReader reader = command.ExecuteReader(CommandBehavior.SequentialAccess);
  
          int columnCount = reader.FieldCount;
          for (int i = 0; i &lt; columnCount; i++)
          {
              SqlCommand sCommand = new SqlCommand("ALTER TABLE " + tableName + " ADD " + reader.GetName(i) + " varchar(MAX)", Program.myConnection2);
              sCommand.ExecuteNonQuery();
          }
  
          string row="";
          while (!reader.IsClosed)
          {
              try
              {
                  row = "";
                  reader.Read();
                  for (int i = 0; i &lt; columnCount; i++)
                  {
                      if (reader != null)
                      {
                              if (reader.GetString(i).Contains('\''))
                              {
                                  Console.WriteLine("REPLACED QUOT");
                                  String s = reader.GetString(i).Replace("\'", "A");
                                  Console.WriteLine(s);
                                  row += s;
                              }
                              else
                              {
                                  row += "\'" + reader.GetString(i).Trim() + "\',";
                              }
  
                         // Console.WriteLine("FILLER: " + reader.GetString(i));
                      }
                      //Console.WriteLine(row);
                  }
                  //Console.WriteLine();
                  row = row.Substring(0, row.Length - 1);
                  SqlCommand insertCommand = new SqlCommand("INSERT INTO " + tableName  + " VALUES(\'1\'," + row + ")", Program.myConnection2);
                  insertCommand.ExecuteNonQuery();
              }
              catch (SqlException exp)
              {
                  Console.WriteLine(exp.StackTrace);
                  Console.WriteLine(row);
                 // this.Close();
              }
          }
          Program.myConnection2.Close();
      }
  </code></pre>