SQL ASP.NET Insert troubles

Question

First let me tell you that i have searched at least a day long for awnsers, so i finally thought lets give this a try.

I am trying to create this shoppingcart for a schoolproject, but i am struggeling with the code. A teacher (sql) told me to check the database and there were some mistakes (not my fault). I fixed these small errors.

Now when i just do SELECT xxxx FROM xxx = no errors, everything show in the gridview. when i add the 2nd part i get a "Syntax error in FROM clause". adding the 3rd part and excluding 2nd part is same error.

Maybe the only thing i could come up with was this little thing in the database: Field properties General Indexed: Yes(No Duplicates)

its probably something minor, but it is driving me nuts, so any help is very much appreciated.

Here is the relevant code:

protected void Page_Load(object sender, EventArgs e)
        {
            if (Request.QueryString["add"] == null)
            {
                Response.Redirect("producten.aspx");
            }
            else
            {
                Label a = new Label();
                a.Text = Request.QueryString["add"];
                lbl_testing.Text = a.Text;

                OleDbConnection conn = new OleDbConnection();
                conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0; "
                    + "Data Source=|DataDirectory|webwinkel.accdb";

                OleDbCommand cmd = new OleDbCommand();
                cmd.Connection = conn;
                cmd.CommandText = "SELECT prijs , product_id FROM Product" +
                                  "WHERE product_id ='" + lbl_testing.Text + "'";

                //"INSERT INTO Orderregels(prijsperstuk, product_id)" +

                try
                {
                    conn.Open();
                    OleDbDataReader reader = cmd.ExecuteReader();
                    Label1.Text = "";
                    GridView1.DataSource = reader;
                    GridView1.DataBind();
                    reader.Close();
                }
                catch (Exception exc)
                {
                    Label1.Text = exc.Message;
                }
                finally
                {
                    conn.Close();
                }
            }

        }

KV Prajapati · Accepted Answer · 2012-07-09 02:32:37Z

3

You have to add spaces between TableName and WHERE clause.

cmd.CommandText = "SELECT prijs , product_id FROM Product " 
                         + "WHERE product_id ='" + lbl_testing.Text + "'";

Use parameters to avoid such issues and SQL Injection.

  cmd.CommandText = "SELECT prijs , product_id FROM Product WHERE product_id=@productid";
  cmd.Parameters.Add("@productid",OleDbType.VarChar,10).Value=lbl_testing.Text;
  //if Id is `numeric` type then use
  //cmd.Parameters.Add("@productid",OleDbType.Integer.Value=lbl_testing.Text;

edited Jul 9, 2012 at 2:32

answered Jul 9, 2012 at 2:27

KV Prajapati

94.8k20 gold badges151 silver badges188 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

dwerner Over a year ago

+1 Since you're using C#, use string literals to avoid annoyances like this. They can span multiple lines. @"select prijs ..."

NinjaBomb Over a year ago

You would benefit greatly from using parameters from the start. It's just a good habit and best practice.

Big.S Over a year ago

@AVD , THANK YOU!!! i mean really you just relieved me from 2 days of stressing out. THANKS!!

Big.S Over a year ago

@NinjaBomb they never teached us how. But yea, i will NOT forget the hard lesson learned

Collectives™ on Stack Overflow

SQL ASP.NET Insert troubles

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related