Get data from sql server into textbox error message

Question

protected void DropDownServerName_SelectedIndexChanged(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["Database_Shared_NotebookConnectionString"].ConnectionString);

        conn.Open();

        string serverName = DropDownServerName.SelectedValue;

        string sqlquery = ("SELECT Architecture FROM tblServer WHERE (ServerName = " + serverName + ")");

        SqlCommand command = new SqlCommand(sqlquery, conn);

        txtUpdateArchitecture.Text = command.ExecuteScalar().ToString();

        conn.Close();
    }

The DropDownServerName aready connected to SQL Server using SqlDataSource to show list of values on ServerName column.

After I get select value called "Brad" and I want value from Architecture column from Brad to show up on textbox. However I got error say, Invalid column name "Brad". The column is suppose to be ServerName and Brad is just a value in ServerName column.

codingbiz · Accepted Answer · 2012-10-11 19:07:29Z

3

You need quote around your servername

string sqlquery = ("SELECT Architecture FROM tblServer WHERE (ServerName = '" + serverName + "')");

Or better still, use Parameterized query [it is safer, against SQL Injection and funny characters in string that can pollute your query]

string sqlquery = "SELECT Architecture FROM tblServer WHERE ServerName = @ServerName";

SqlCommand command = new SqlCommand(sqlquery, conn);
command.Parameters.AddWithValue("@ServerName", serverName);

edited Oct 11, 2012 at 19:07

answered Oct 11, 2012 at 18:59

codingbiz

26.4k9 gold badges62 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Patko Over a year ago

Better yet, use parameters to avoid SQL injection.

Scott Selby Over a year ago

nice , other are telling this guy to concatenate rather then telling him to use parameters

Patko Over a year ago

Maybe SO should have some algorithm to detect this and would redirect to stackoverflow.com/questions/601300/what-is-sql-injection or something similar :)

Andrew · Accepted Answer · 2012-10-11 18:59:59Z

0

Try this instead. It should work with the single quotes.

string sqlquery = ("SELECT Architecture FROM tblServer WHERE ServerName = '" + serverName + "'");

answered Oct 11, 2012 at 18:59

Andrew

8359 silver badges18 bronze badges

1 Comment

Scott Selby Over a year ago

never concatenate like that , use paramaters

Z . · Accepted Answer · 2012-10-11 18:59:33Z

0

add ' ' around servername in the WHERE clause:

... WHERE ServerName = '" + serverName + "' ...

answered Oct 11, 2012 at 18:59

Z .

12.8k2 gold badges34 silver badges59 bronze badges

1 Comment

Scott Selby Over a year ago

never concatenate like that , use paramaters

jags · Accepted Answer · 2012-10-11 19:11:37Z

0

You probably are missing single quotes around the variable. Try this

    protected void DropDownServerName_SelectedIndexChanged(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["Database_Shared_NotebookConnectionString"].ConnectionString);

        conn.Open();

        string serverName = DropDownServerName.SelectedValue;

        string sqlquery = ("SELECT Architecture FROM tblServer WHERE (ServerName = '" + serverName + "')");

        SqlCommand command = new SqlCommand(sqlquery, conn);

        txtUpdateArchitecture.Text = command.ExecuteScalar().ToString();

        conn.Close();
    }

edited Oct 11, 2012 at 19:11

answered Oct 11, 2012 at 19:00

jags

2,07026 silver badges34 bronze badges

3 Comments

codingbiz Over a year ago

You have introduced more syntax error into that query with the wrong placement of the quotes. But I didn't downvote

jags Over a year ago

@codingbiz thanks I have corrected it though my answer is not correct. Others have posted correct answer about using parameterized query instead of using single quotes in the same query.

codingbiz Over a year ago

Your answer is correct but is discouraged for security reason.

Collectives™ on Stack Overflow

Get data from sql server into textbox error message

4 Answers 4

3 Comments

1 Comment

1 Comment

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

1 Comment

1 Comment

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related