title: c# Insert data into MySQL database using parameters
body: <p>This probably a simple solution, but I've got a deadline to catch and I don't know the exact problem here. 
  So here's the deal, I'm trying to update my table using this piece of code:</p>
  
  <pre><code>    private void btn_opslaan_Click(object sender, EventArgs e)
      {
          string opleidingsid = "Select OpleidingsID From opleidingen Where Opleidingsnaam = '" + cb_opleiding.Text + "'";
          MySqlCommand cmdid = new MySqlCommand(opleidingsid, dbconnect.connection);
          dbconnect.OpenConnection();
          MySqlDataReader reader = cmdid.ExecuteReader();
          reader.Read();
              int oplid = (int)reader.GetValue(0);
  
          cmdid.Dispose();
          reader.Close();
          sql = "UPDATE leerlingen SET Naam = '_naam', Adres = '_adres', Woonplaats = '_woonplaats', Postcode = '_postcode', Email = '_email', Telefoonnummer = '_telefoonnummer', Klas = '_klas', Ovnummer = '_ovnummer', OpleidingsID = '_opleidingsid', Startdatum = '_startdatum', Einddatum = '_einddatum' WHERE LeerlingID = '_leerlingid'";
  
        //  sql = "UPDATE leerlingen set Naam  = '" + txt_naam.Text + "', Adres = '" + txt_adres.Text + "', Woonplaats = '" + txt_woonplaats.Text + "', Postcode = '" + txt_postcode.Text + "', Email = '" + txt_email.Text + "', Telefoonnummer = '" + txt_telefoonnumer.Text + "', Klas = '" + txt_klas.Text + "', Ovnummer = '" + txt_ovnummer.Text + "', OpleidingsID = '" + oplID + "', Startdatum = '"+mc_startdatum.SelectionStart.Date.ToString()+"', Einddatum = '"+ mc_einddatum.SelectionStart.Date.ToString() +"' WHERE LeerlingID = '" + Int32.Parse(lbl_leerlingid.Text) + "'";
          MySqlCommand cmd = new MySqlCommand(sql, dbconnect.connection);
  
          cmd.Parameters.AddWithValue("_naam", txt_naam.Text);
          cmd.Parameters.AddWithValue("_adres", txt_adres.Text);
          cmd.Parameters.AddWithValue("_woonplaats", txt_woonplaats.Text);
          cmd.Parameters.AddWithValue("_postcode", txt_postcode.Text);
          cmd.Parameters.AddWithValue("_email", txt_email.Text);
          cmd.Parameters.AddWithValue("_telefoonnummer", txt_telefoonnumer.Text);
          cmd.Parameters.AddWithValue("_klas", txt_klas.Text);
          cmd.Parameters.AddWithValue("_ovnummer", txt_ovnummer.Text);
          cmd.Parameters.AddWithValue("_opleidingsid", oplid);
          cmd.Parameters.AddWithValue("_startdatum", mc_startdatum.SelectionStart.Date.ToString());
          cmd.Parameters.AddWithValue("_einddatum", mc_einddatum.SelectionStart.Date.ToString());
          cmd.Parameters.AddWithValue("_leerlingid", int.Parse(lbl_leerlingid.Text));
  
          try
          {
              cmd.ExecuteNonQuery();
              MessageBox.Show("opslaan gelukt");
          }
          catch (Exception error)
          {
              MessageBox.Show(error.ToString());
              throw;
          }
          dbconnect.CloseConnection();
  
          this.Close();
  
      }
  </code></pre>
  
  <p>I've already tried without the single quotes, it would give me the error that colomn '_leerlingid' does not exist, but that is the parameter...
  Now, I dont get any errors, but it wouldn't update my database.
  Any help please</p>
  
  <p>P.S. Ignore the sql injection please, before this , i didn't knew better before I found out about parameters.</p>