Click here to Skip to main content
15,921,793 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hi I trying to get Data from my sql server tables. I have two comboboxes with a botton. I have fill the combobox with tables from the server and am now trying to retrieve some Infos within both tables BUT am getting the Message:
Object reference not sent to an instance of an objet or in german
Der objektverweis wurde nicht auf eine objektinstanz festgelegt

Here my click_btn code. Can somone help?
C#
SqlConnection con = new SqlConnection(CS);

            // TSQL Statement
            SqlCommand cmd = new SqlCommand();
            cmd.Connection = con;
            cmd.CommandText = (@" SELECT [GWU Planung mit AZ], [GWU Vorschau mit AZ], [Projektdefinition DB] FROM " + cbSelect1.SelectedValue.ToString() + 
                                "WHERE [Projektdefinition DB] = 'T.016002108' AND [Planungskostenelement (j/n)] = 'Nein' " +
                                " UNION SELECT [GWU Planung mit AZ], [GWU Vorschau mit AZ], [Projektdefinition DB] FROM " + cbSelect2.SelectedValue.ToString() + 
                               "WHERE [Projektdefinition DB] = 'T.016002108' AND [Planungskostenelement (j/n)] = 'Nein' " + "");


            SqlDataAdapter adapter = new SqlDataAdapter(cmd); // adapter is return the result in Datagridview

            // IF STATEMENT

            if (cbSelect1.SelectedValue.ToString() != null && cbSelect2.SelectedValue.ToString() != null)
            {
                try
                {
                    // Open connection
                    con.Open();
                    DataTable dtRecord = new DataTable();
                    adapter.Fill(dtRecord);
                    dataGridView1.AutoGenerateColumns = true;
                    dataGridView1.DataSource = dtRecord;
                    //dataGridView1.AutoResizeColumns(DataGridViewAutoSizeColumnsMode.AllCells);
                    con.Close();
                    
                }

                catch (Exception ex)
                {
                    MessageBox.Show(ex.Message);
                }
                finally
                {
                    con.Close();
                }

            }
            else
            {
                MessageBox.Show("ERROR");
            }
Posted
Updated 16-Oct-14 2:58am
v2
Comments
M.Farrukh Abbas 16-Oct-14 7:59am    
first of all instead of cbSelect2.SelectedValue.ToString() used Convert.ToString() and !string.isNullorEmpty() function because .tostring() can not handle null value its always gives error on null or empty string.
try to change the code on above suggestion if not solve then specify exact location where you get this error.
Thanks7872 16-Oct-14 9:00am    
At which line? Go through all the objects in the line where you faced the error, you will find one of the object as null. Try to make changes such that it should not be null.
Sinisa Hajnal 16-Oct-14 9:04am    
And dispose of the command object too.
[no name] 16-Oct-14 9:10am    
What line are you getting the error on above?
mikybrain1 16-Oct-14 9:13am    
Hithere a no error in the code but if a run the app, it message me the error above and i don't know why

1 solution

You are doing it wrong. Your SQL statement is composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327[^].

Richard Deeming is absolutely right in his comment to the question: you should use parametrized statements.

[EDIT]

Please also see our discussion with Richard in comments below. He convinced me that the protection from SQL injection is harder to perform on a desktop application. Such injection is still possible, but, in this case, not that simple; it can be done, say, via reverse-engineering of the client application, which is also pretty easy.

Still, parametrized statement makes sense; understanding of importance of parametrized statements is still… important. Possibility of SQL injection is not the only factor; there is a number of other important reasons: better performance, readability, maintenance.

[END EDIT]

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection[^].

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx[^].

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();[^],
hi name is not displaying in name?[^].

Now, about the null exception you have:

You did not show where the exception with the message "Object reference not set to an instance of an object" is thrown.

Not to worry. This is one of the very easiest cases to detect and fix. It simply means that some member/variable of some reference type is dereferenced by using and of its instance (non-static) members, which requi8res this member/variable to be non-null, but in fact it appears to be null. Simply execute it under debugger, it will stop the execution where the exception is thrown. Put a break point on that line, restart the application and come to this point again. Evaluate all references involved in next line and see which one is null while it needs to be not null. After you figure this out, fix the code: either make sure the member/variable is properly initialized to a non-null reference, or check it for null and, in case of null, do something else.

Please see also: want to display next record on button click. but got an error in if condition of next record function "object reference not set to an instance of an object"[^].

Sometimes, you cannot do it under debugger, by one or another reason. One really nasty case is when the problem is only manifested if software is built when debug information is not available. In this case, you have to use the harder way. First, you need to make sure that you never block propagation of exceptions by handling them silently (this is a crime of developers against themselves, yet very usual). The you need to catch absolutely all exceptions on the very top stack frame of each thread. You can do it if you handle the exceptions of the type System.Exception. In the handler, you need to log all the exception information, especially the System.Exception.StackTrace:
http://msdn.microsoft.com/en-us/library/system.exception.aspx[^],
http://msdn.microsoft.com/en-us/library/system.exception.stacktrace.aspx[^].

The stack trace is just a string showing the full path of exception propagation from the throw statement to the handler. By reading it, you can always find ends. For logging, it's the best (in most cases) to use the class System.Diagnostics.EventLog:
http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlog.aspx[^].

Good luck,
—SA
 
Share this answer
 
v3
Comments
Richard Deeming 16-Oct-14 13:16pm    
Actually, I deleted my comment because this one's not so straightforward. You can't use a parameter to specify a table name in the FROM clause, which is what the OP is doing.

The only sensible approach is to validate that the table name is one of the expected values. Since the values are taken from (what I assume is) a drop-down list, this has probably already been done.

It's still not nice, but there isn't a simple fix this time.
Sergey Alexandrovich Kryukov 16-Oct-14 13:25pm    
Thank you very much, Richard.

Deleted comments are visible to be, and I noticed that it was deleted, but only later.
Even if this is not a fix, I think the code is still vulnerable, to the same very SQL injection, so this advice is not completely useless.

As to direct validation against the set of valid table names, why not? Would you post it as a separate answer then? Maybe you can suggest some more elegant way of doing it...

—SA
Richard Deeming 16-Oct-14 13:31pm    
I've assumed that the drop-down lists only contain valid table names, and can't be modified by the user, so further validation of the names shouldn't be necessary.

I haven't posted that as an answer, as it's not an answer to the OP's question.
Sergey Alexandrovich Kryukov 16-Oct-14 13:36pm    
These values can be faked well too easily, albeit not just by typing. Yes, they can be "modified by the user", only by a less naive user. Easily. But naive users won't even try to attach the site. For those who can attach the site, constant set of values is not a problem. Everything which is done on client site can easily be faked.

So yes, parametrized statements are still helpful.

As to not posting, it's your choice, of course. I only wanted to note: in my opinion, helping is more important then answering a question (which may or may not make sense). So, I never hesitate to answer "wrong question" if I think it could be helpful. A help to fix a critical mistake not mentioned in a question is exactly such case.

So, anyway, thank you for providing so many useful answers on this forum.

—SA
Richard Deeming 16-Oct-14 13:43pm    
It depends on the platform.

Unless you disable it, ASP.NET WebForms automatically validate that the value posted to a DropDownList control is one of the expected values.
Page.EnableEventValidation[^]

Windows Forms and WPF don't provide any sensible way for the user to modify the values in the list. I suppose there might be some clever hack using low-level Windows APIs to modify the content of the list.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900