Click here to Skip to main content
15,899,935 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Dear I would like you help me
I have table that have datetime together, I want to display data in DataGridView. I am using DateTimePicker to get info but, it does not show anything and give me error.

could you help me guys.

What I have tried:

here is my code to
<pre>SELECT * FROM TBL_LI_T WHERE FT >='" + this.FirstDate.Text + "' AND ET<= '" + this.SecondDate.Text + "'
Posted
Updated 16-Mar-21 20:48pm
Comments
Maciej Los 17-Mar-21 3:12am    
What database?
Karam Ibrahim 19-Jun-21 0:21am    
I have SQL database connect to C# I was wanted to get info between two dates. However, thanks I get my solution.
Richard MacCutchan 17-Mar-21 5:01am    
If the table items are DateTimes then you cannot use Text strings in the comparison.
Karam Ibrahim 19-Jun-21 0:22am    
Yes, you right bro. However, thanks I get my solution.

1 solution

Don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

Start my fixing that through your whole app, then validate and convert your dates before sending them to SQL:
C#
DateTime start;
if (!DateTime.TryParse(FirstDate.Text, out start)
   {
   ... report problem to user ...
   return;
   }
And similar for the end date.
Then pass your converted values to SQL via parameters.
 
Share this answer
 
Comments
Karam Ibrahim 19-Jun-21 0:20am    
Thanks OriginalGriff solution. I solved my problem.
OriginalGriff 19-Jun-21 1:48am    
You're welcome!

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900