请验证我的ASP.NET代码以将数据插入oracle数据库

无论我做什么，下面的代码似乎都不起作用。它总是在

ExecuteNonQuery（）

处中断

我遗漏了什么

总是扔

System.InvalidOperationException:“由于对象的当前状态，操作无效。”

---

定义命令要使用的连接时，您没有使用conn。使用下面的行。阅读有关用法的详细信息

---

您从未将OracleConnection

conn

分配给OracleCommand

cmd

。您应该使用参数化查询和绑定变量。您正在使用的代码具有SQL注入漏洞。

protected void Submit_Click(object sender, EventArgs e)
{
    if (Page.IsValid)
    {
        OracleConnection conn = new OracleConnection(connectionString);
        int room_id = Int32.Parse(DropDownList2.SelectedValue);
        int activity_id = Int32.Parse(DropDownList1.SelectedValue);
        string session_code = TextBox1.Text;
        int start_time = GetTimeSeconds(startTime.Text);
        int period = GetTimeSeconds(duration.Text);
        string book_date = bookDate.Text;
        string ref_no = DropDownList3.SelectedValue;

        conn.Open();

        using (OracleCommand cmd = new OracleCommand(
            "insert into BRAZESH.ALL_SESSION(SESSION_CODE,START_TIME,\"PERIOD\",BOOKED_DATE,ROOM_ID,ACTIVITY_ID,REF_NO)" +
            " values ('" + session_code + "'," + start_time + "," + period + ",to_date('" + book_date + "', 'yyyy-mm-dd')," + room_id + "," + activity_id + ", '" + ref_no + "')"))
        {
            try
            {
                cmd.ExecuteNonQuery();
            }catch (OracleException ex)
            {
                throw ex;
            }
        }

    }
}

    using (OracleCommand cmd = new OracleCommand(
        "insert into BRAZESH.ALL_SESSION(SESSION_CODE,START_TIME,\"PERIOD\",BOOKED_DATE,ROOM_ID,ACTIVITY_ID,REF_NO)" +
        " values ('" + session_code + "'," + start_time + "," + period + ",to_date('" + book_date + "', 'yyyy-mm-dd')," + room_id + "," + activity_id + ", '" + ref_no + "')",conn))