What is the error in my code?

Question

0.00/5 (No votes)

See more:

SQL-Server-2008R2

Dear Friends,

Please tell me the error in bellow query,

C#

SqlCommand cmd = new SqlCommand("select * from tblCategories where CategoryName=" + Request.QueryString["CategoryName"], con);

Note: I want to bind the values based on string in Repeater control.

Thanks in advance.

Posted 22-Jul-15 21:01pm

Member 10021658

Updated 22-Jul-15 21:11pm

Suvendu Shekhar Giri

v2

Add a Solution

Comments

Praveen Kumar Upadhyay 23-Jul-15 3:11am

There is nothing wrong in the query. Can you please brief a little more.

Member 10021658 23-Jul-15 3:19am

I want to bind the value to repeater control based on string values.
Please follow bellow example based on above query .

I have two tables like tblCategories(CategoryId, CategoryName) & tblSubCategories (CateoryName, Id, SubCategoryName). Now I would like to bind the subcategories based on categoryName. I hope you understand my issue.

2 solutions

Solution 1

use parameter

C#

SqlCommand cmd = new SqlCommand("select * from tblCategories where CategoryName=@CategoryName", con);
cmd.Parameters.AddWithValue("@CategoryName", Request.QueryString["CategoryName"]);

Or in your inline parameter specify it as string, by using ''

C#

SqlCommand cmd = new SqlCommand("select * from tblCategories where CategoryName='" + Request.QueryString["CategoryName"]+"'", con);

but Parameterized sql query is more safe and it will protect your application from sql injection attacks.

Posted 22-Jul-15 21:16pm

DamithSL

Updated 22-Jul-15 21:18pm

v2

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Suvendu Shekhar Giri · Accepted Answer · 2015-07-22T21:16:00

The only visible error is you have missed to wrap your value for CategoryName within a pair of single quotes.
Try this-

C#

SqlCommand cmd = new SqlCommand("select * from tblCategories where CategoryName='" + Request.QueryString["CategoryName"]+"'", con);

Note: It is always recomended to use parameterized query or stored procedure to prevent SQL Injection.
Reference:
Using Parameterized queries to prevent SQL Injection Attacks in SQL Server[^]
http://www.dotnetperls.com/sqlparameter[^]
SQL Injection Attacks and Some Tips on How to Prevent Them[^]

Hope, it helps :)