Search button and Display in Data Grid in Winforms

Question

0.00/5 (No votes)

See more:

Data is Not displaying in DataGridview by searching Name
What Should I do...
Plz help me...

C#

private void button1_Click(object sender, EventArgs e)
{
  SqlConnection con = new SqlConnection("Data Source=SUBHAN-PC;Initial Catalog=subhan;Integrated Security=True");
  DataTable dt = new DataTable();
  SqlDataAdapter da = new SqlDataAdapter("select * from ghtdetails where EmployeeName='"+textBox1.Text+"'", con);
  
  da.Fill(dt);
  da.ToString();
  dataGridView1.DataSource = dt;

Posted 26-Nov-14 0:29am

123456789shaik

Updated 26-Nov-14 0:57am

Tomas Takac

v2

Add a Solution

Comments

Richard Deeming 26-Nov-14 9:10am

Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

2 solutions

Solution 2

replace your code with below code

SqlDataAdapter da = new SqlDataAdapter("select * from ghtdetails where EmployeeName LIKE '%"+textBox1.Text+"%'", con);

Posted 26-Nov-14 1:04am

ClimerChinna

Updated 26-Nov-14 1:06am

Comments

Richard Deeming 26-Nov-14 9:11am

You've copied the SQL Injection[^] vulnerability from the question.

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Marcin Kozub · Accepted Answer · 2014-11-26T00:59:00

Hello,

I think that's because you are using '=' operator for employee name instead of 'LIKE'. '=' operator means that you are looking for exact match. 'LIKE' operator allows you to search using wildcards (partial searching). Try code below:

C#

private void button1_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection("Data Source=SUBHAN-PC;Initial Catalog=subhan;Integrated Security=True");
            
    DataTable dt = new DataTable();

    string query = "SELECT * FROM ghtdetails WHERE EmployeeName LIKE @EmployeeName";

    // If user checks CheckBox control then filter by salary rang
    if (chkFilterBySalary.Checked)
    {
        query = query + " AND Salary >= @SalaryFrom";
        query = query + " AND Salary <= @SalaryTo";
    }
            
    SqlDataAdapter da = new SqlDataAdapter(query, con);
    var command = da.SelectCommand;
    command.Parameters.AddWithValue("EmployeeName", string.IsNullOrWhiteSpace(textBox1.Text) ? "%" : textBox1.Text);

    if (chkFilterBySalary.Checked)
    {
        command.Parameters.AddWithValue("SalaryFrom", nudSalaryFrom.Value);
        command.Parameters.AddWithValue("SalaryTo", nudSalaryTo.Value);
    }

    da.Fill(dt);
    da.ToString();
    dataGridView1.DataSource = dt; 
}

[Update 1]
1. 'LIKE' operator can be used with STRING type fields only. I'm assuming that 'Salary' is numeric type (single, double or decimal). So, you can use '=', '>', '>=', '<' or '<=' operators only for filtering.
2. You can not have two 'WHERE' keywords in one query. To set more than one filter condition use 'AND' or 'OR' keywords.
3. In my opinion it's better to separate filtering by text and numeric fields. To do that add new controls to your Form: one CheckBox (name it: chkFilterBySalary) and two NumericUpDown controls (name them: nudSalaryFrom and nudSalaryTo) and update your code.

[Update 2]
Added use of parametrized query. Based on Richard Deeming's comment.

I hope it help you.