InsertCommand inside of code behind - asp.net

Question

I came across the followng code in the code behind and wondering
if this may be a good practice in terms of inserting a record
programmatically:
protected void ButtonMain_Click(object sender, EventArgs e)
{
string sConn = ConfigurationManager.ConnectionStrings["SQL1"].ConnectionString;
SqlDataSource dbQ = new SqlDataSource();
dbQ.ConnectionString = sConn;
dbQ.InsertCommand = "INSERT INTO data1_DropDownLists (ParamID, ddlValue) VALUES ('" + ddlAllParams.SelectedValue + "','" +
txtddl.Text + "')";
dbQ.Insert();
DropDownGrid.DataBind();
dbQ = null;
}
What I have seen is before is something like:
string query = "INSERT INTO data1_DropDownLists vALUES ...";
cmd = new SqlCommand(query, conn);
conn.Open();
cmd.ExecuteNonQuery();
so was not sure of what the benefit may be to using the above method using InsertCommand

Answer 1

The SqlDataSource is a control in the System.Web namespace. It can be used as datasource for web-databound controls like Repeater or GridView.
It is a control which should be used declaratively on the aspx markup and not in codebehind. It's like an interface between the GUI and the DAL. Normally you should avoid this kind of hardlinking. Instead you should separate GUI(ASPX), BLL(codebehind or class libraries etc.) and DAL (ADO.NET or Entity framework etc.).
I would suggest to use the most direct way, using an ADO.NET SqlCommand:
// use using-statement to ensure that the connection gets closed even in case of an error
using (var con = new SqlConnection(connectionString))
{
using (var cmd = new SqlCommand("INSERT INTO dbo.Table(Column)VALUES(#Column)", con))
{
// use parameters to avoid SQL-Injection
cmd.Parameters.AddWithValue("#Column", value);
con.Open();
cmd.ExecuteNonQuery();
}
}

Answer 2

The SqlDataSource class has four command properties, one for each sql action: SelectCommand, InsertCommand, UpdateCommand, DeleteCommand.
Once an instance is created, each of the command property can be set.
The class also exposes a two arguments constructor SqlDataSource(String, String) where the second argument specifies the SELECT command text.