Du skal indstille Connection-egenskaben for Command-objektet og bruge en forespørgsel i parameterstørrelse i stedet for hårdkodet SQL for at undgå SQL-injektion.
using(SqlConnection openCon=new SqlConnection("your_connection_String"))
{
string saveStaff = "INSERT into tbl_staff (staffName,userID,idDepartment) VALUES (@staffName,@userID,@idDepartment)";
using(SqlCommand querySaveStaff = new SqlCommand(saveStaff))
{
querySaveStaff.Connection=openCon;
querySaveStaff.Parameters.Add("@staffName",SqlDbType.VarChar,30).Value=name;
.....
openCon.Open();
querySaveStaff.ExecuteNonQuery();
}
}