Display values in label from SQL Server query

Question

I'm trying to load the values to label from a SQL query:

sc.Open();
string type = Vehicle_cost.SelectedText;
string query = ("select Type from Vehicle_Registor where Reg_No = '" + type + "';");

SqlCommand cmd1 = new SqlCommand(query, sc);
SqlDataReader sdr = cmd1.ExecuteReader();
label23.Text = sdr.ToString();
sc.Close();

SQL Injection alert - you should not concatenate together your SQL statements - use parametrized queries instead to avoid SQL injection — marc_s
– marc_s, Commented Sep 27, 2015 at 9:34

Amnesh Goel · Accepted Answer · 2015-09-27 09:45:03Z

1

Try below code..

sc.Open();

string query = @"select Type from Vehicle_Registor where Reg_No = @Reg_No";

SqlCommand cmd1 = new SqlCommand(query, sc);
cmd1.Parameters.AddWithValue("@Reg_No", Vehicle_cost.SelectedText);

SqlDataReader sdr = cmd1.ExecuteReader();
sdr.Read();

label23.Text = sdr[0].ToString();

sc.Close();

edited Sep 27, 2015 at 9:45

answered Sep 27, 2015 at 9:37

Amnesh Goel

2,6553 gold badges35 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

marc_s Over a year ago

You should check out Can we stop using AddWithValue() already? and stop using .AddWithValue() - it can lead to unexpected and surprising results...

Paviel Kraskoŭski · Accepted Answer · 2015-09-27 09:40:50Z

0

Try something like this:

SqlCommand cmd1 = new SqlCommand(query, sc);
using (SqlDataReader sdr = cmd1.ExecuteReader())
{
    while (sdr.Read())
    {
        for (int i = 0; i < sdr.FieldCount; i++)
        {
            label23.text += sdr[i].ToString();
        }
    }
}
sc.Close();

answered Sep 27, 2015 at 9:40

Paviel Kraskoŭski

1,4299 silver badges16 bronze badges

2 Comments

Amnesh Goel Over a year ago

Handle OP's problems properly while answering. First query itself is subject to SQLInjection and why do you think he needs a loop to iterate. One registration per vehicle, concept is simple.

Paviel Kraskoŭski Over a year ago

@AmneshGoel If query returns scalar value maybe it's more reasonable to use ExecuteScalar?

Collectives™ on Stack Overflow

Display values in label from SQL Server query

2 Answers 2

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related