Execute scalar column name C#

Question

1.00/5 (2 votes)

See more:

If put in text box username (a) and password (a) app say invalid column name "a"
 
Last line problem....some help?

 korisnikId = Int32.Parse(myCommand.ExecuteScalar().ToString());

What I have tried:

private void prijava()  
        {  
              
  
            SqlConnection myConnection = new SqlConnection(cs);  
            String command = "SELECT id FROM osobe_korisnici where korisnicko_ime = " + korisnikTextBox.Text + "";  
            myConnection.Open();  
            SqlCommand myCommand = new SqlCommand(command, myConnection);  
            
            korisnikId = Int32.Parse(myCommand.ExecuteScalar().ToString());

Posted 23-May-18 20:25pm

Goran Bibic

Add a Solution

Comments

Richard MacCutchan 24-May-18 4:07am

What is the problem?

Goran Bibic 24-May-18 4:19am

' " + korisnikTextBox.Text + " ' ";

This, but I solve the problem

try to solve this

Goran Bibic 24-May-18 4:19am

Need string to label

InitializeComponent();
korisnickoImeLabel.Text = getKorisnickoIme();

What I wrong?
Query is ok

private String getKorisnickoIme()
{
SqlConnection myConnection = new SqlConnection(cs);
String value = "SELECT ime_prezime FROM osobe_korisnici WHERE id='" + korisnikId + "'";
SqlCommand cmd = new SqlCommand(value, myConnection);
myConnection.Open();
SqlDataReader rdr = cmd.ExecuteReader();
return value;

}

Result in label is
SELECT ime_prezime FROM osobe_korisnici WHERE id='10'

id is 10, but I need to write in label name and surname for user (ime_prezime)

Maciej Los 24-May-18 4:52am

Goran, seems you don't want to learn....
We have told you several times yet that you have to use parameterized queries instead of concatenated string to avoid SQL Injection... But you still are ignoring ours instructions...
Bad practice turns you into bad programmer.

Goran Bibic 24-May-18 13:57pm

I want to learn

Maciej Los 24-May-18 15:55pm

So, why do you ignore ours comments?

Richard MacCutchan 24-May-18 5:04am

Look at that code. You create a SELECT statement in value and then return that from your method. You ignore the results of the call to ExecuteReader.

Goran Bibic 24-May-18 7:20am

I am solve the problem alone...

Richard Deeming 24-May-18 9:12am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Goran Bibic 24-May-18 13:55pm

Thank you

RedDk 24-May-18 18:16pm

If you really want to use that concatenation string you can and it's very easy. But as far as learning TSQL and getting versed in the string operators which will take precedence in this case, the best thing to do is get SQL Server Express with Advanced (stuff), install that ... and also download the BOL (Book-on-Line) for whatever the version is that you choose.

Doing SQL things like using a connection string to sheboogle the database is fine from C# ... don't get me wrong. But the TSQL documentation in the BOL can't be beat. (Also while I'm thinking of it, download the AdventureWorks sample data affair ... there's lot's of this example sprinkled throughout the BOL and there's nothing they don't do there that can't be done by any novice picking up the skill determinately.)

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)