System.Data.SqlClient.SqlException: 'Invalid column name '"

Question

I have written the below code in dataGridView celldouble click event with full row select, so whenever I double click the row it should feed back to textbox and comboxes.

But I'm getting the error "System.Data.SqlClient.SqlException: 'Invalid column name 'new1'.'" where new 1 is the genderm in this field. Instead of reading combobox2 's value it's reading genderm

SqlConnection conn = new SqlConnection(config.constring);
SqlCommand command = new SqlCommand("SELECT rangemaster.code as 
     code, rangemaster.genderm as [Male], rangemaster.genderf as [Female], 
     rangemaster.age as [Age], rangemaster.agerange as [Age Range], 
     rangemaster.commonrange as [Common Range], testmaster.testname as 
    [Test Name] FROM rangemaster LEFT JOIN testmaster ON rangemaster.code = 
    testmaster.code where rangemaster.code = " + 
    dataGridView1.SelectedRows[0].Cells[0].Value.ToString() + "", conn);

conn.Open();
using (SqlDataReader reader = command.ExecuteReader())
    while (reader.Read())
    {

        name4.Text = reader[0].ToString();
        textBox4.Text = reader[1].ToString();
        textBox3.Text = reader[2].ToString();
        comboBox1.SelectedIndex = Convert.ToInt32(reader[3]) - 1;
        textBox5.Text = reader[4].ToString();
        textBox1.Text = reader[5].ToString();

        comboBox2.SelectedIndex = Convert.ToInt32(reader[6]) - 1;

    }
conn.Close();

@apomene + that injection is no possible. And you can do procedure on SQL, and your code will be Sql var command = new SqlCommand("ProcedureName", conn) { CommandType = CommandType.StoredProcedure }, use Execute reader and read that, or best use Dapper (wrapper on Sql net) — xSx
– xSx, Commented May 8, 2019 at 11:23

apomene · Accepted Answer · 2019-05-08 11:21:11Z

4

The problem is that you are missing quotes. In any case the correct solution, is to use SQL parameters like:

SqlCommand command = new SqlCommand("SELECT rangemaster.code as ... where rangemaster.code = @param");
command.Parameters.Add("@param",SQlDbType.Nvarchar).Value = dataGridView1.SelectedRows[0].Cells[0].Value.ToString();

answered May 8, 2019 at 11:21

apomene

14.4k10 gold badges51 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

BugFinder · Accepted Answer · 2019-05-08 11:25:47Z

0

You arent putting in quotes..

your code

"..where rangemaster.code = " + 
    dataGridView1.SelectedRows[0].Cells[0].Value.ToString() + "", conn);

If the content of the cell is new1 then it will read where rangemaster.code = new1 .. you need to put quotes round it, what would be better would be to use parameters and save from injection

so

SqlCommand command = new SqlCommand("SELECT ... where rangemaster.code = @code", conn);
command.Parameters.AddWithValue("@code",dataGridView1.SelectedRows[0].Cells[0].Value.ToString());

answered May 8, 2019 at 11:25

BugFinder

17.9k4 gold badges42 silver badges58 bronze badges

1 Comment

BugFinder Over a year ago

Partly evil - but its still better than before.

Chirag Gawde · Accepted Answer · 2019-05-08 11:33:57Z

The problem is that you are missing the quotes. You have to add "" at the end.

SqlCommand command = new SqlCommand("SELECT rangemaster.code as ... where rangemaster.code = @param");
command.Parameters.Add("@param",SQlDbType.Nvarchar).Value = dataGridView1.SelectedRows[0].Cells[0].Value.ToString() + "", conn);

You can use this but i would suggest you to use parameters. They can save you from a SQL Injection.

Use Something Like this:

SqlCommand command = new SqlCommand("SELECT rangemaster.code as ... where rangemaster.code = @param");
command.Parameters.Add("@param",SQlDbType.Nvarchar).Value = dataGridView1.SelectedRows[0].Cells[0].Value.ToString();

Always practice this for more secure code.

Collectives™ on Stack Overflow

System.Data.SqlClient.SqlException: 'Invalid column name '"

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related