"ORA-00917: missing comma" & vbLf - oracle

Question

Below is my query which is created in .Net code for insertion in oracle table. I found other related articles but they are different and not answering this. I was creating below query using a datatable.
`Public Sub UpdateOracleRecordset(dtTable As DataTable)
Dim sql As String = String.Empty
Dim i As Integer = 0
sql = "insert into " + dtTable.TableName + "("
For Each dc As DataColumn In dtTable.Columns
sql = sql + dc.ToString() + ","
Next
sql = sql.TrimEnd(",") + ")" + " select "
Dim rowVal As String = String.Empty
For Each dtRow As DataRow In dtTable.Rows
For Each dc As DataColumn In dtTable.Columns
rowVal = rowVal + dtRow(dc).ToString() + ","
Next
rowVal = rowVal.TrimEnd(",")
Next
sql = sql + rowVal
ExecuteSQL(sql)
End Sub`
"insert into CS_INV(LOANNO,CASENUMBER,INQ_TYPE,FUP_REASON,FUP_DATE,FUP_PROM,USERID,DATA_DAT,UNIT) values ( 5735985,103550709,399,58,9/24/2018 1:37:01 AM,9/25/2018 12:00:00 AM,Anurag,9/24/2018 1:37:08 AM,1 ) "

Answer 1

Wenfried is right and I used prepared statements which helped to resolve the issue
Dim conn As New OracleConnection(oradb)
conn.Open()
Dim sql As String = String.Empty
Dim sqlValues As String = String.Empty
Dim i As Integer = 0
sql = "insert into " + dtTable.TableName + "("
For Each dc As DataColumn In dtTable.Columns
sql = sql + dc.ToString() + ","
sqlValues = sqlValues + ":" + dc.ToString() + ","
Next
sql = sql.TrimEnd(",") + ")" + " values ( " + sqlValues.TrimEnd(",") + ")"
Dim commandText = sql
Dim Command As New OracleCommand(sql, conn)
For Each dtRow As DataRow In dtTable.Rows
For Each dc As DataColumn In dtTable.Columns
Command.Parameters.Add(New OracleParameter(dc.ToString(), dtRow(dc)))
Next
Next
Command.ExecuteNonQuery()
conn.Close()