Incorrect syntax near ')'. when trying to insert values into the database

Question

I'm new and this is my first question.

I'm trying to insert a value into the database and I get the error message

Incorrect syntax near ')'.

and cmd.ExecuteNonQuery() gets highlighted. Here's my code:

con.Open()
cmd = New SqlCommand("INSERT INTO orders ('" + IDProduct.Text + "')", con)
cmd.ExecuteNonQuery()
con.Close()

Answer 1

Firstly, NEVER, NEVER NEVER build sql queries like this. Use parameterized queries instead.

Secondly, you're missing "VALUES" in your sql command.

INSERT INTO orders VALUES ( .... )

edit:

Thirdly, as marc_s suggests, it's a good idea to specify column names as well. That way you can avoid some surprises later.