VB.Net with mySql issue?

Question

I am Searching and Block registration for duplicate ID from mysql Database using VB.Net 2010. I have got: you have an error in your sql syntax....

Please can you to help me in this? What will be the mistake i made? What will be the correct way?

Imports System.IO
Imports MySql.Data.MySqlClient
Imports System.Data.SqlClient

    Public Class Add_Clients
        Private Sub CheckClient()
            Dim myquery As String = ""
            Dim mycmd As MySqlCommand

            myquery = "select * from clients where client_id=" & clid.Text
            mycmd = New MySqlCommand(myquery, con)
            Dim idno As Integer = mycmd.ExecuteNonQuery()

            If idno < 0 Then
      MsgBox("The Client is already Exist!", MsgBoxStyle.Exclamation, "Car Rental System")
                Return
            End If

        End Sub

Your SQL Statement is wrong. the whole statement should be inside the Double Codes e.g "select * from clients where client_id=clid.Text" — I kiet
– I kiet, Commented Feb 20, 2014 at 13:57

chris_techno25 · Accepted Answer · 2014-02-20 14:00:52Z

1

Your query should be like this...

 myquery = "SELECT * FROM clients WHERE client_id='" & clid.Text.Replace("'","''").Trim() & "'"

The additional .Replace("'","''").Trim() should protect you from SQL injection. This should work for now... But you later have you use parametized queries to avoid SQL hacks :) So for now, practice SQL statements first.

answered Feb 20, 2014 at 14:00

chris_techno25

2,5176 gold badges22 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Ismail.ethio Over a year ago

Thanks very much. Nice advise really!

chris_techno25 Over a year ago

Your welcome :) Practice SQL statements first... Then move on to parametized queries :) One step at a time.

ron tornambe · Accepted Answer · 2014-02-20 14:35:12Z

0

You should use a parameterized query. It simplifies the code while guarding against injection attacks.

myquery = "select * from clients where client_id=@clid" 
**mycmd = New MySqlCommand(myquery, con)**
mycmd.Parameters.AddWithValue("@clid", clid.Text);

edited Feb 20, 2014 at 14:35

answered Feb 20, 2014 at 14:02

ron tornambe

10.8k8 gold badges38 silver badges61 bronze badges

2 Comments

Ismail.ethio Over a year ago

Your code has error near mycmd "Object reference not set to an instance of an object." check it!

ron tornambe Over a year ago

You have a point, but i do not see where your con(nection) object is being set either. In any case, you should get into the habit of using parameters.

Collectives™ on Stack Overflow

VB.Net with mySql issue?

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related