This answer will address 2 issues
- Protecting from SQL injection using Parameterized Queries
- Converting to numeric values when required
1+2. (Please note that for expedience I did not code for all your parameters )
In your Code Behind:
using (SqlConnection conn = new SqlConnection(connStr))
{
SqlCommand cmd = new SqlCommand();
cmd.Connection = conn;
cmd.CommandType = CommandType.Text;
cmd.CommandText = "INSERT INTO SalesActivity(Activity_ID, Date, Quatation_Number, Customer_ID, Product_ID, Quantity, valueGBR, valueEUR, Rate, weightedValue, Status_ID, estDecisionDate, PromisedDeliveryDate) values(@Activity,@Date, @param3 ,@param4,@param5,@param6,@param7,@param8,etc................... )"; }
cmd.Parameters.AddWithValue("@Activity", Convert.ToInt32(txtActivity.Text));
}
....Do this for all your parameters (convert to Int32 as required)