Click here to Skip to main content
15,918,889 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I'm working on the Registration page for Lucky Draw system.So the process for registration is user need to scan their barcode using usb barcode scanner. I stuck on that part which i cannot check the employee id on database after user scan or type in the textbox. I also want to display the employee name after scan the barcode.Can anyone give me some ideas/solution.

What I have tried:

Below are my code:

C#
using System;  
using System.Collections.Generic;  
using System.Data;  
using System.Data.SqlClient;  
using System.IO;  
using System.Linq;  
using System.Web;  
using System.Web.UI;  
using System.Web.UI.WebControls;
public partial class Attendance : System.Web.UI.Page  
{  
    SqlCommand cmd = new SqlCommand();  
    SqlConnection con = new SqlConnection();  
    string str;  
    private string connectionString;  
  
    protected void Page_Load(object sender, EventArgs e)  
    {  
        con.ConnectionString = @"Data Source= (LocalDB)\MSSQLLocalDB; AttachDbFilename =   
          C:\Users\Nor  Asyraf  Mohd No\source\repos\LuckyDraw\LuckyDraw\App_Data\ticket.mdf;   
            Integrated Security = True";
        txtText.Focus();  
    }  
  
    protected void btnSave_Click(object sender, EventArgs e)  
    {  
        idcheck();  
        using (SqlConnection connection = new SqlConnection(connectionString))  
        {  
            using (SqlCommand command = connection.CreateCommand())  
            {  
                command.CommandText = "UPDATE EMPLOYEES SET Attendance = 'Present' WHERE EMP_ID = @id";  
                command.Parameters.AddWithValue("@id", txtText.Text);  
                connection.Open();  
  
                command.ExecuteNonQuery();  
  
                connection.Close();  
            }  
        }
    }  
  
public void idcheck()  
        {
        string query = "select EMP_ID from EMPLOYEES where EMP_ID='" + txtText.Text + "'";  
        SqlDataAdapter ada = new SqlDataAdapter(query, con);  
        DataTable dt = new DataTable();  
        ada.Fill(dt);  
        if (dt.Rows.Count > 0)  
        {  
            lblError.Text = dt.Rows[0]["EMP_NAME"].ToString();  
        }  
    }
    protected void Button1_Click1(object sender, EventArgs e)  
    {  
        Response.Redirect("Default.aspx");  
    }  
}
Posted
Updated 22-Mar-18 19:45pm
Comments
Bryian Tan 22-Mar-18 22:12pm    
what the error message? try the update with an integer. command.Parameters.AddWithValue("@id", 1);

The second query does not have EMP_NAME in the select statement.
Member 13700339 22-Mar-18 22:25pm    
Error message:

System.Data.SqlClient.SqlException: 'An attempt to attach an auto-named database for file C:\Users\Nor Asyraf Mohd No\Documents\Visual Studio 2017\LuckyDraw\LuckyDraw\App_Data\ticket.mdf failed. A database with the same name exists, or specified file cannot be opened, or it is located on UNC share.'
Richard Deeming 23-Mar-18 13:17pm    
string query = "select EMP_ID from EMPLOYEES where EMP_ID='" + txtText.Text + "'";


That code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

You already know how to use parameters - you're using them correctly in the btnSave_Click method.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Considering your ID column is interger then you have to correct these line
"select EMP_ID from EMPLOYEES where EMP_ID='" + txtText.Text + "'"; "

as "select EMP_ID from EMPLOYEES where EMP_ID= " + txtText.Text + " "; " remove single quotes.
 
Share this answer
 
add EMP_NAME in select query and if EMP_ID is integer remove single quotes from where condition
 
Share this answer
 
Execute the SqlCommand string select * from the database table of yours
Try to execute with the
datareader = cmd.ExecuteReader() and read the data from the database like
if(datareader.Read())
label.InnerText = datareader["EmpID"].ToString();

Here i use <label> tag instead of <asp:label> tag.... It worked for me try this
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900