C# Count number of rows in sql result

Question

Connection c = new Connection();
public string checkIfExists(string Name)
    {
        string sql = "SELECT * FROM users WHERE name = '" + name + "'";
        c.Execute(sql);

        return "";
    }

The c.Execute(sql) is calling a SqlCommand function to execute the sql query.

I want to know how to count the number of rows retrieved by this query.

Ignore the return.

You have a SQL injection vulerability.

SLaks
– SLaks

2017-05-18 16:40:43 +00:00
Commented May 18, 2017 at 16:40 — SLaks
– SLaks, Commented May 18, 2017 at 16:40
Possible duplicate of Capturing count from an SQL query

Burgi
– Burgi

2017-12-05 18:33:01 +00:00
Commented Dec 5, 2017 at 18:33 — Burgi
– Burgi, Commented Dec 5, 2017 at 18:33

Community · Accepted Answer · 2017-05-23 12:02:56Z

9

Make sure your SQL is protected from SQL injection attack by parameterizing it
Rewrite SQL to return COUNT
Use ExecuteScalar to retrieve the answer

The query should look like this:

var sql = "SELECT COUNT(*) FROM users WHERE name = @Name";

edited May 23, 2017 at 12:02

CommunityBot

11 silver badge

answered May 18, 2017 at 16:41

Sergey Kalinichenko

729k85 gold badges1.2k silver badges1.6k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dispersia Over a year ago

since the name of his method is checkIfExists, it would probably be better to just grab the indexed key and call .HasRows. It would be a little faster and clearly define what he wants (assuming what he says he wants doesn't actually match his method name, since it doesn't return a bool either).

Sergey Kalinichenko Over a year ago

@Dispersia That is certainly true. I wanted OP to concentrate on the basics, though, so that he could eliminate a critical vulnerability and get an answer to his query first, and worry about the performance later. Good chances are, he'll find performance of this solution acceptable, and wouldn't worry about optimizing it any further.

Dispersia Over a year ago

This is true, was just food for thought more for the OP, since his method naming and return types don't even really match up :)

Rafael Duarte Over a year ago

The @Name will get the name variable received in the method or do I have to create a parameter?

Sergey Kalinichenko Over a year ago

@RafaelDuarte You need to create a parameter, and set its value to method's parameter Name (C# naming conventions suggest lower case for n in name). Follow the first link in the answer for info on how to work with parameters. There's more than one way; different answers from that linked Q&A show code examples.

Maks Orlov · Accepted Answer · 2017-06-09 07:07:45Z

3

Here is Sam SQL query:

SELECT COUNT(1) FROM nazvaniyami
SQL query with condition:

SELECT COUNT(1) FROM nazvaniyami WHERE condition
Implementation in PHP:

$a = mysql_query("SELECT COUNT(1) FROM navaneetham");
$b = mysql_fetch_array( $a );
echo $b[0]; // prints the number of rows

Likewise, it is possible to add a condition. Then the code prints the number of rows in the table satisfying the condition. Thank you for your attention, with you was Maxim

edited Jun 9, 2017 at 7:07

answered May 20, 2017 at 16:33

Maks Orlov

314 bronze badges

Collectives™ on Stack Overflow

C# Count number of rows in sql result

2 Answers 2

5 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

5 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related