Question: I am trying to install a MSI that is supposed to create database and install all the applications that go with it. Every time when it comes to the create database line the MSI is failing complaining 

> 
> "The user does not have access to create database"
> 
> 
> 

But in reality user has sysadmin access on the SQL Server. When I try to create DB directly through SSMS it works fine.

Its a 2016 SQL Server installed on a 2016 Windows Server.

Answer: 
Like this...

```
private void DBConn()
{
    string ConString = "datasource = localhost; Username = root; Password=; database = logbook";
    MySqlConnection DBConnnect = new MySqlConnection(ConString);
    try
    {
        DBConnnect.Open();
        MySqlCommand cmd = DBConnnect.CreateCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "insert into tbl_data (Student_Number, Name, Strand, Section) values(@student_number, @name, @strand, @section)";
        cmd.Parameters.AddWithValue("student_number", textBox1.Text);
        cmd.Parameters.AddWithValue("name", textBox2.Text);
        cmd.Parameters.AddWithValue("strand", textBox3.Text);
        cmd.Parameters.AddWithValue("section", textBox4.Text);
        cmd.ExecuteNonQuery();
        DBConnnect.Close();
        MessageBox.Show("Student registered successfully");
    }
    catch (Exception e)
    {
        MessageBox.Show(e.Message);
    }
}

```
The official [SqlCommand.Parameters Property](https://learn.microsoft.com/en-us/dotnet/api/system.data.sqlclient.sqlcommand.parameters?view=netframework-4.8) has everything you need.

```
cmd.CommandText = "INSERT INTO tablename(column1,column2,column3) VALUES(@column1,@column2,@column3)

```

There is some discussion about risks of `AddWithValue` so you may want to opt for the Add(...).Value approach.

```
command.Parameters.Add("@column1", SqlDbType.Int).Value = x;
command.Parameters.Add("@column2", SqlDbType.Int).Value = y;
command.Parameters.Add("@column3", SqlDbType.Int).Value = z;

```

---

You should be using the `using` statement.

```
var commandText = "INSERT INTO tablename(column1,column2,column3) VALUES(@column1,@column2,@column3)

using (SqlConnection connection = new SqlConnection(connectionString))
{
    SqlCommand command = new SqlCommand(commandText, connection);

    command.Parameters.Add("@column1", SqlDbType.Int).Value = x;
    command.Parameters.Add("@column2", SqlDbType.Int).Value = y;
    command.Parameters.Add("@column3", SqlDbType.Int).Value = z;
    try
    {
        connection.Open();
        Int32 rowsAffected = command.ExecuteNonQuery();
        Console.WriteLine("RowsAffected: {0}", rowsAffected);
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

```