Command Text, Textbox

Question

1.00/5 (3 votes)

See more:

Is this code correct?

C#

SqlCommand cmd = new SqlCommand();

cmd.Connection = cn;
cmd.CommandType=CommandType.Text
cmd.CommandText= "SELECT * FROM Orders2 WHERE Monthname = '" + textBox1.Text.ToString() + "' AND '" + textBox2.Text.ToString() + "'"

Thanks in Advance

Posted 10-Dec-10 22:26pm

wolfsor

Updated 11-Dec-10 1:49am

Abdul Quader Mamun

v4

Add a Solution

Comments

Khaniya 11-Dec-10 5:32am

It looks ok
but what is your problem ?
where are you getting error ??

Abdul Quader Mamun 11-Dec-10 6:10am

Use pre tag.

Toli Cuturicu 11-Dec-10 7:41am

TextBox.Text is already a string. It is absurd to call ToString() on a string! It returns the same string!

Toli Cuturicu 11-Dec-10 7:42am

SQL injection attacks are just waiting to happen! NEVER concatenate SQL queries with user input!

Toli Cuturicu 11-Dec-10 7:49am

And don't repost! NEVER! Edit your original questin instead!

Toli Cuturicu 11-Dec-10 7:58am

I had to delete your third repost.
Edit your questions instead of reposting!

3 solutions

Solution 1

As far as I know, this looks ok.

Posted 10-Dec-10 22:30pm

Abhinav S

Comments

wolfsor 11-Dec-10 4:39am

I'm sorry... i have just updated the question

SqlCommand cmd = new SqlCommand();

cmd.Connection = cn;
cmd.CommandType=CommandType.Text
cmd.CommandText= "SELECT * FROM Orders2 WHERE Monthname = '" + textBox1.Text.ToString() + "' AND '" + textBox2.Text.ToString() + "'"

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Abdul Quader Mamun · Accepted Answer · 2010-12-11T00:11:00

Solution 3

C#

cmd.CommandText= "SELECT * FROM Orders2 WHERE Monthname = '" + textBox1.Text + "' AND Monthname = '" + textBox2.Text + "'";

Posted 11-Dec-10 0:11am

Abdul Quader Mamun

Updated 11-Dec-10 1:48am

v4

Comments

Toli Cuturicu 11-Dec-10 7:47am

What about sql injection?
Never heard of parametrized queries or stored procedures?

fjdiewornncalwe 12-Dec-10 10:12am

Abdul: Please read the other answers first before you post an answer identical to someone else's. Just add a comment to the correct answer showing your agreement.

Abdul Quader Mamun 12-Dec-10 23:53pm

@Marcus: Question was not clear. And we are not taking Exam. Just help to you from our valuable time. Like programmers who are unable to do this.

fjdiewornncalwe 13-Dec-10 14:23pm

It was perfectly clear. You gave a clear answer. It takes less time to read the existing answers and provide a comment then it does to create your own answer. Unless of course, you're just rep point mining.

RaviRanjanKr · Accepted Answer · 2010-12-10T23:58:00

Solution 2

No it's not correct

C#

/*...*/"WHERE Monthname = '" + textBox1.Text.ToString() + "' AND '" + textBox2.Text.ToString() + "'"

:confused:

That will be the correct command when you are using AND operator:

C#

cmd.CommandText = "SELECT * FROM Orders2 WHERE Monthname = '" + textBox1.Text + "' AND  Monthname ='" + textBox2.Text + "'";

:)

Posted 10-Dec-10 23:58pm

RaviRanjanKr

Updated 11-Dec-10 1:46am

v5

Comments

Toli Cuturicu 11-Dec-10 7:47am

What about sql injection?
Never heard of parametrized queries or stored procedures?

ShilpaKumari 12-Dec-10 7:07am

Good Answer..