Click here to Skip to main content
15,924,367 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Can anyone know this.

This is my coding.

In this code in a database price is there which datatype is varchar and in this bulletedlist i have given the price but it gets only the string but i want that instead of string the value should be passed like 500.


C#
protected void BulletedList3_Click(object sender, BulletedListEventArgs e)
    {
        price = BulletedList3.Items[e.Index].Value;
        if (con.State == ConnectionState.Closed)
        {
            con.Open();
        }
        switch (price)
        {
            case "Below Rs.500/-":
                SqlCommand cmd = new SqlCommand("select pro_img,pro_name,price from product where price='" + price + "' and status='A' and type='retail'", con);
                SqlDataAdapter da = new SqlDataAdapter(cmd);
                DataSet ds = new DataSet();
                da.Fill(ds);
                DataList1.DataSource = ds;
                DataList1.DataBind();
                 break;
Posted
Updated 21-Nov-11 18:07pm
v2

1 solution

You need to parse the string to extract the price value and use the result to pass to the SQL command.

You should also learn to use parameters for SQL commands rather than string concatenation, as this opens your app up to SQL injection[^] attacks.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900