How do I solve the error no given value for one or required parameter at oledbreader in ASP.NET

Question

1.00/5 (1 vote)

See more:

I have a webpage called blogwebsite and in that I have a textbox and search button. I am passing the value of textbox on button click to another webform called blogseacrh through session. I also have a database bound through these webforms. In this blogsearch webpage I have taken the session variable in a textbox. Using this textbox value I am writing a oledbcommand select query. I am fetching data from the database using this textbox value and want to display it on the blogsearch webpage. For this to happen I am using oledbdatareader to read the data and then write the fetched data in the textbox. But when I am running the webpage when I click on search button it gives me the error at the oledbdatareader line saying that no given value given for one or more required parameters.

I really can't understand what I am doing wrong. Can someone please give me a solution?

This is the button click event which is working perfectly

protected void btn_srch_Click(object sender, EventArgs e)
{
Session["name"] = txt_bnm.Text;
Response.Redirect("blogseacrh.aspx");
}

This is the code that needs to be executed on another webpage on button click event

protected void Page_Load(object sender, EventArgs e)
{
if (Session["name"] != null)
{
con.Open();

txt2_bnm.Text = Session["name"].ToString();

cmd = new OleDbCommand("select user from tbl_blogs where book_name='" + txt2_bnm.text + "',con); `

OleDbDataReader d = cmd.ExecuteReader();
while (d.Read())
{
user = d["user"].ToString();
Response.Write(user);
}
cmd = new OleDbCommand("select blogs from tbl_blogs where book_name='" + txt2_bnm.Text + "' ", con);

OleDbDataReader dr = cmd.ExecuteReader();
while (dr.Read())
{
blogs = dr["blogs"].ToString();
Response.Redirect(blogs);
}
con.Close();
}

I have also checked all the field names and table name and they are all correct as well.

What I have tried:

can someone please help me solve this error.

Posted 12-Apr-21 6:11am

Member 15148158

Updated 12-Apr-21 22:05pm

Add a Solution

Comments

Richard Deeming 13-Apr-21 4:06am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Patrice T · Answer 1 · 2021-04-12T06:24:00

Solution 1

Compare those 2 lines

C#

cmd = new OleDbCommand("select user  from tbl_blogs where book_name='" + txt2_bnm.text + "' ,con); `  
//                                                            here is missing a double quote ^
...                              
cmd = new OleDbCommand("select blogs from tbl_blogs where book_name='" +  txt2_bnm.Text + "' ", con);

[Update]

Quote:
but can you please give me another solution?

The problem is that the error I spotted prevent compilation of your code, this imply that you can't get this error message with this code.
So, as long as you don't show actual code and complete error message, no one can help you further.

Posted 12-Apr-21 6:24am

Patrice T

Updated 12-Apr-21 19:46pm

v3

Comments

Member 15148158 12-Apr-21 12:56pm

I have added the double quite but even then its showing me the same error that value not given for one or more parameters

This is the edited code

con.Open();
cmd =new OleDbCommand("select user from tbl_blogs where book_name='" + txt2_bnm.Text + "' ",con);

OleDbDataReader d = cmd.ExecuteReader();
while (d.Read())
{
user = d["user"].ToString();
txt_anm.Text = user.ToString();
}

con.close();

Patrice T 12-Apr-21 15:55pm

Use Improve question to update your question.
So that everyone can pay attention to this information.

Member 15148158 13-Apr-21 1:34am

but can you please give me another solution?

Richard MacCutchan · Answer 2 · 2021-04-12T22:05:00

Solution 2

C#

txt2_bnm.Text = Session["name"].ToString();

cmd = new OleDbCommand("select user from tbl_blogs where book_name='" + txt2_bnm.text + "',con); `

The spelling of text is incorrect, it should be Text with a leading capital.

Posted 12-Apr-21 22:05pm

Richard MacCutchan