this is my code
sqlcommand=new sqlcommand("inset into table values('"+home.name'"+,'"+home.DOJ'")",con);
You're using the local default string conversion from DateTime
(I assume) to string, and then hoping that's valid for SQL.
Additionally, your code has a SQL injection attack vulnerability.
Both of these can be fixed - and your code readability - can be improved using parameterized SQL:
using (var command = new SqlCommand(
"INSERT INTO Foo (Name, DOJ) Values (@Name, @DOJ)", connection))
{
command.Parameters.Add("@Name", SqlDbType.VarChar).Value = home.name;
command.Parameters.Add("@DOJ", SqlDbType.DateTime).Value = home.DOJ;
...
}
(Adjust the types accordingly, e.g. using SqlDbType.NVarChar
and SqlDbType.DateTime2
.)
Never put values directly into SQL like you were doing. Using parameterized SQL is a win all round.
See more on this question at Stackoverflow