Click here to Skip to main content
15,885,366 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hello,



Forgive me my English that I do not understand ... thank you translator, thanks.
I can not solve a sql search
My current code works well and tells me what I want.

C#
string RechMstpe18 = "Armoire";
   string RechEmail19 = "NON";
   string date1 = DateTime.Now.ToShortDateString(); 

SQL
sql = "Select * from Tble_MES_121 WHERE (Statut LIKE '" + RechMstpe18 + "%')" +
                " AND (Email LIKE '" + RechEmail19 + "%') AND (Date_vente IS NULL)";


I need to add the code below to improve my search ... but that does not work.

SQL
AND (DATEadd(dd, -7, CONVERT(Date_fin_vente)) Like '" + date1 + "%')


Who can help me solve this problem ?


thank,

What I have tried:

C#
connectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|\resources\BDD_Suivi_vente.accdb;Persist Security Info=False";

sql = "Select * from Tble_MES_bds_121 WHERE (Statut LIKE '" + RechMstpe18 + "%')" +
                " AND (Email LIKE '" + RechEmail19 + "%') AND (Date_MES IS NULL) AND (DATEadd(dd, -7, CONVERT(Date_fin_MSTPE)) Like '" + date1 + "%')";
Posted
Updated 27-Feb-19 9:17am

IF a DATE-field IS NULL it cannot be a filled date. SO the filled dates are excluded in your WHERE clause
Perhaps:
SQL
AND (Date_MES IS NULL OR Date_MES BETWEEN (DATEadd(dd, -7, CAST( date1 As DAteTime) AND CAST( date1 As DAteTime))

as part of your query
 
Share this answer
 
Comments
LSB71 1-Mar-19 1:49am    
Hello digimanus,
Thank you for your help,
I can not find the solution.
At first I would like to make it easier to understand the meaning.
For example :
(Statut LIKE ? + '%') AND (Email LIKE ? + '%') AND (Date_MES IS NULL OR Date_MES BETWEEN (date1 = Date_fin_MSTPE))";
For simplicity date1 = Date_fin_MSTPE
But I get an error
How to do ?

thank you so much
I do not have the answer for you, my MS Access is a little rusty and Dates in there were not my strong point.
Examples of using dates as criteria in Access queries - Access[^]

However; I am obligated to point out that you are using code that is susceptible to SQL Injection. You should NEVER piece together an SQL statement from combining strings together.
The proper way to add the variables into this would be to use placeholders within your query and then add Parameters to the OLE Command. OLE restricts the placeholders to the question mark (?), and the values that are added need to be in the exact order to fill in the prepared statement.

This is roughly what your query should look like
C#
connectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|\resources\BDD_Suivi_vente.accdb;Persist Security Info=False";

sql = "Select * from Tble_MES_bds_121 WHERE (Statut LIKE ? + '%') AND (Email LIKE ? + '%') AND (Date_MES IS NULL) AND (DATEadd(dd, -7, CONVERT(Date_fin_MSTPE)) Like ? '%')";

OleDbCommand cmd = new OleDbCommand(sql, connection);
cmd.Parameters.AddWithValue("@Statut", RechMstpe18);
cmd.Parameters.AddWithValue("@Email", RechEmail19);
cmd.Parameters.AddWithValue("@MSTPE", date1);
 
Share this answer
 
Comments
LSB71 27-Feb-19 12:10pm    
Thank you very much, I take note of your remarks.
C#
sql = "Select * from Tble_MES_121 WHERE (Statut LIKE '" + RechMstpe18 + "%')" + " AND (Email LIKE '" + RechEmail19 + "%') AND (Date_vente IS NULL)";

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
 
Share this answer
 
Hello,
thank you for your interest in my code.
Here is the excerpt of the modified move.
C#
 string connectionString = null;
 OleDbConnection cnn;
 string sql = null;
 OleDbDataReader reader;

 string RechMstpe18 = "MSTPE";
 string RechEmail19 = "NON";

 string date1 = DateTime.Now.ToShortDateString();   // DAte J

//   MessageBox.Show("" + date1);

 connectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|\resources\BDD.accdb;Persist Security Info=False";
 sql = "Select * from Tble_MES_bds_121 WHERE " +
         "(Statut LIKE ? + '%')" + // Is there the word MSTPE
         " AND (Email LIKE ? + '%')" + // Is there the word NO for email
         " AND (Date_MES IS NULL)"; // The date DATE_MES is fast

     //  it's these three conditions are gathered so I can send a message by email ..
     //  BUT! I have to send an email 7 days before the end of the date(DATE_fin _MSTPE)

     cnn = new OleDbConnection(connectionString);
     cnn.Open();
     OleDbCommand cmd = new OleDbCommand(sql, cnn);

     cmd.Parameters.AddWithValue("@Statut", RechMstpe18);
     cmd.Parameters.AddWithValue("@Email", RechEmail19);
     cmd.Parameters.AddWithValue("@MSTPE", date1);

     reader = cmd.ExecuteReader();

     while (reader.Read())

     { //  HERE my code }

     reader.Close();
     cmd.Dispose();
     cnn.Close();

It is quite possible that several e-mails will leave at the same time.
For each line checked, when today's date is 7 days from the end date of (Date_fin_MSTPE).
Thank you
 
Share this answer
 
Comments
LSB71 27-Feb-19 15:18pm    
Can I attach an picture to support my question ?
CHill60 28-Feb-19 8:51am    
No

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900