Click here to Skip to main content
15,887,485 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
String s11="Select student.sname,admission.sroll,admission.scourse,admission.semester from admission,student where admission.asid=(get value from the textbox) and admission.asid=student.sid";
Posted
Comments
PIEBALDconsult 1-Apr-15 13:00pm    
Use a parameterized query.

You can follow this process

C#
using (SqlCommand command = new SqlCommand("Select student.sname,admission.sroll,admission.scourse,admission.semester from admission,student where admission.asid=@Variable and admission.asid=student.sid", connection))
{
	command.Parameters.Add(new SqlParameter("Variable", txtVariable.Text.Trim()));
	SqlDataReader reader = command.ExecuteReader();
	DataTable dataTable = new DataTable();
	dataTable.Load(reader); 
}
 
Share this answer
 
v2
Comments
Richard Deeming 1-Apr-15 14:15pm    
#2 is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.
Arkadeep De 1-Apr-15 15:03pm    
ya I know, but if you use '' then it will consider as a string and chances are less. But still I will go with you. #1 is no doubt better than #2.
Arkadeep De 1-Apr-15 15:14pm    
#2 has been removed....
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900