Click here to Skip to main content
15,898,538 members
Please Sign up or sign in to vote.
3.00/5 (1 vote)
See more:
i try but this error show

C#
Invalid SQL statement; expected 'DELETE', 'INSERT', 'PROCEDURE', 'SELECT', or 'UPDATE'.


What I have tried:

SQL
cmd = new OleDbCommand("SELECT InvoiceNo,p_custname,payment_date,FinalTotal,P_totalpayment,P_paymentdue,Reminder_Date from Payment where Reminder_Date ='" + System.DateTime.Now + "'", con);
Posted
Updated 12-May-16 19:53pm
v2

1 solution

Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
C#
using (cmd = new OleDbCommand("SELECT InvoiceNo,p_custname,payment_date,FinalTotal,P_totalpayment,P_paymentdue,Reminder_Date from Payment where Reminder_Date = @DT, con))
   {
   cmd.Parameters.AddWithValue("@DT", System.DateTime.Now);
   ...
   }
And you problem will also disappear...
 
Share this answer
 
Comments
Sabhani Vipul 13-May-16 4:10am    
How to Enter Date Value Default NULL in insert query ???
OriginalGriff 13-May-16 4:24am    
Pass DBNull.Value as a parameter.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900