Добавьте изображение и путь к базе данных для конкретных пользователей

protected void Upload(object sender, EventArgs e)
    {
        //Extract Image File Name.
        string fileName = Path.GetFileName(FileUpload1.PostedFile.FileName);

        //Set the Image File Path.
        string filePath = "~/Uploads/" + fileName;

        //Save the Image File in Folder.
        FileUpload1.PostedFile.SaveAs(Server.MapPath(filePath));
        string mycon = "server =localhost; Uid=root; password = ; persistsecurityinfo = True; database =ovs; SslMode = none";

        MySqlConnection con1 = new MySqlConnection(mycon);
      //  string sql = "INSERT INTO candidate VALUES(@Name, @Path)";
        MySqlCommand cmd = null;
        cmd = new MySqlCommand("INSERT INTO candidate(candidateImage,path where studentID ='" + Session["UserName"] + "') VALUES (@Name,@Path)", con1);

                cmd.Parameters.AddWithValue("@Name", fileName);
                cmd.Parameters.AddWithValue("@Path", filePath);
        con1.Open();
        cmd.ExecuteNonQuery();
        con1.Close();
    }

When the users click the upload button, the image and path will be saved to the database that belongs to the specific users. For example, the users with ID R1001 login into their account, and when they click the upload button, the picture and path will be saved under the R1001 in the database. I show the error message which suggests there is a syntax error, but I not able to find it. The sample column will be like 
StudentID              Name    Path
R1001
After users click submit, the name and path will be added