C# Mysql Select with Textbox Text

Question

Im trying to select a row in mysql database using a textbox's text. However when I use the following code I get an error.

        MySqlCommand command = connection.CreateCommand(); //we create a command
        command.CommandText = "SELECT * FROM info where id=" + textBox1.Text ;  //in commandtext, we write the Query
        MySqlDataReader reader = command.ExecuteReader();  //execute the SELECT command, which returns the data into the reader

        while (reader.Read())  //while there is data to read
        {
            MessageBox.Show(reader["info"].ToString());
        }

It works fine with letters but when I try to use a question mark or anything like that i get the following error:

"Parameter '?' must be defined."

MySql.Data.MySqlClient.MySqlException was unhandled HResult=-2147467259 Message=Parameter '?' must be defined. Source=MySql.Data ErrorCode=-2147467259 — user3540727
– user3540727, Commented Apr 16, 2014 at 10:30
With the current condition, your code is vulnerable to sql injection attacks. I urge you to consider using parameters as given in the answers below. — mcy
– mcy, Commented Apr 16, 2014 at 10:44
Hold up, what or where are you putting this '?' ? And WHY do you have it? — TheGeekZn
– TheGeekZn, Commented Apr 16, 2014 at 11:16
Im putting this ? in my textbox, I have it because I need to grab data from a columm that has a ? in it. — user3540727
– user3540727, Commented Apr 16, 2014 at 11:20

Nagaraj S · Accepted Answer · 2014-04-16 10:34:55Z

1

instead of

command.CommandText = "SELECT * FROM info where id=" + textBox1.Text ;

Use this

command.CommandText = "SELECT * FROM info where id=@id";
command.Parameters.AddWithValue("@id",textBox1.Text);

answered Apr 16, 2014 at 10:34

Nagaraj S

13.5k6 gold badges35 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

TheGeekZn Over a year ago

Always best practice.

Damith · Accepted Answer · 2014-04-16 10:52:24Z

0

you better use parameters in this case

command.CommandText = "SELECT * FROM info where id=@id";

then you need to set the parameter value

command.Parameters.AddWithValue(@id, textBox1.Text);

full code:

   string queryString="SELECT * FROM info where id=@id";
   using (MySqlConnection connection = new MySqlConnection(connectionString))
   using (MySqlCommand command = new MySqlCommand(queryString, connection))
   {
        connection.Open();
        command.Parameters.AddWithValue("@id", textBox1.Text);
        using (MySqlDataReader reader = command.ExecuteReader())
        {
            while (reader.Read())
            {
                // do something ...
            }
        }
    }

update :

change your parameter value setting line as below

 command.Parameters.AddWithValue("@id", textBox1.Text);

edited Apr 16, 2014 at 10:52

answered Apr 16, 2014 at 10:29

Damith

63.2k13 gold badges106 silver badges154 bronze badges

5 Comments

user3540727 Over a year ago

I can't seem to get it working how would I add your code into my existing? Here is my code I have at the moment: pastebin.com/raw.php?i=k87zcCn9

Damith Over a year ago

@user3540727 you need to set parameter value as command.Parameters.AddWithValue("@id", textBox1.Text);

user3540727 Over a year ago

When I do this nothing gets returned from the database.

Damith Over a year ago

do you have column nameed 'id' in your info table? what is the column data type?

user3540727 Over a year ago

Yes I do, although I changed where id= to where string=, because I renamed id to string. The data type is TEXT. The info column Is also TEXT.

Collectives™ on Stack Overflow

C# Mysql Select with Textbox Text

2 Answers 2

1 Comment

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related