Click here to Skip to main content
15,887,585 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I have a TreeView that gets data from Sql Server Table. My code populates parent and child nodes successfully. I only want to know how to get the ID filed of the Node in a TextBox when I select any Node.

the ID column name is : cabinetID

Here is the code I use to populate the TreeView:
C#
public void loadContainerTree()
{
    repositoryid = Convert.ToInt32(txtRepositoryID.Text);

    conn.Open();
    SqlDataAdapter adapter = new SqlDataAdapter("SELECT * FROM tblCabinets WHERE ParentID IS NULL AND repositoryID = '" + repositoryid + "'", conn);
    DataTable dt = new DataTable();
    adapter.Fill(dt);

    RadTreeNode parentNode;
    foreach (DataRow dr in dt.Rows)
    {
        parentNode = ContainersTree.Nodes.Add(dr["cabinetName"].ToString());
        PopulateTreeView(dr["cabinetID"].ToString(), parentNode);
    }

    ContainersTree.ExpandAll();
    conn.Close();
}

private void PopulateTreeView(string parentid, RadTreeNode parentNode)
{
    SqlDataAdapter adapterchild = new SqlDataAdapter("SELECT * FROM tblCabinets WHERE ParentID = '" + parentid + "' AND repositoryID = '" + repositoryid + "'", conn);
    DataTable dtchild = new DataTable();
    adapterchild.Fill(dtchild);

    foreach (DataRow dr in dtchild.Rows)
    {
        RadTreeNode childNode;

        if (parentNode == null)
        {
            childNode = ContainersTree.Nodes.Add(dr["cabinetName"].ToString());
        }
        else
        {
            childNode = parentNode.Nodes.Add(dr["cabinetName"].ToString());
            PopulateTreeView(dr["cabinetID"].ToString(), childNode);
        }
        getID = ContainersTree.Nodes.Add(dr["cabinetID"].ToString());
    }
}


What I have tried:

Cabinet.Text = ContainersTree.SelectedNode[0];
Posted
Comments
Richard Deeming 9-Oct-18 11:29am    
SqlDataAdapter adapterchild = new SqlDataAdapter("SELECT * FROM tblCabinets WHERE ParentID = '" + parentid + "' AND repositoryID = '" + repositoryid + "'", conn);

Don't do it like that!

Your code is potentially vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

SqlDataAdapter adapterchild = new SqlDataAdapter("SELECT * FROM tblCabinets WHERE ParentID = @ParentID AND repositoryID = @RepositoryID", conn);
adapterchild.SelectCommand.Parameters.AddWithValue("@ParentID", parentid);
adapterchild.SelectCommand.Parameters.AddWithValue("@RepositoryID", repositoryid);
Emad Ahmed 11-Oct-18 4:11am    
Thanks, I Always use parameterized query as you mentioned, but i just took this code from a tutorial and intended to change it later.
Emad Ahmed 11-Oct-18 4:12am    
But do you have any answer to my original question????

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900