Click here to Skip to main content
15,888,095 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Is my code correct with regard to 'between'.

SqlDataAdapter da = new SqlDataAdapter("select * from txfile where exp_date between '"+v_fd+"' and '"+v_td+"'", con);

Thanks.
Posted

No.
Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
C#
SqlDataAdapter da = new SqlDataAdapter("SELECT * FROM txfile WHERE exp_date BETWEEN @SD AND @ED, con);
da.SelectComand.Parameters.AddWithValue("@SD", v_fd);
da.SelectComand.Parameters.AddWithValue("@SD", v_td);


BTW: It's also considered a bad practice to use SELECT * - you should list the columns you want to retrieve. It can be very wasteful in memory and bandwidth to return columns you don't need.
 
Share this answer
 
may i know what error is coming?

exp_date is datetime data type means please remove single quote. its may be help you to get expect result.



select * from tablename where expdate between value1 and value2

Expdate Datatype is Date then Value1 and Value2 Type should also be Date
if Expdate is Integer then it should also be integer to get exact result.
 
Share this answer
 
v3
Comments
S.Rajendran from Coimbatore 24-May-13 5:14am    
expdate is varchar(10)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900