Sql query in c#

Question

I am programming in C# 2010 Express.

I have a SQL database in my program, one of its tables called HightAndWeightTable that has four columns. I want to select a value from the fourth column that is called Risk based on the height that the user enter in the domain in up down box.

Thus, my SQL query in the program is :

SELECT Risk 
FROM HightAndWeightTable 
WHERE Hight LIKE '%" + domainUpDown1.Text + "%'"

... but this didn't work.

Also, how do we write a SQL query that has a range, e.g. if I want to say a value is in between a range of values?

You have "height" misspelled in the query while "weight" is correct. Double-check your spelling of the table and column names? — Adam Lear
– Adam Lear ♦, Commented Jun 2, 2011 at 19:06
It didn't work because the query has to fetch a value from the Risk column, but it did not. — Victoria
– Victoria, Commented Jun 2, 2011 at 19:36
Did you get an error message or an empty result set? That's what Farshid is getting at. — Adam Lear
– Adam Lear ♦, Commented Jun 2, 2011 at 20:38
using the previous query I specified in my question earlier, in order to get the Risk value that is returned from the sql query, I use these two statmemts to get that value as follows: DataRow dRow3 = ds3.Tables["Hight_Weight"].Rows[0]; double HightFactor =Convert.ToDouble(dRow3.ItemArray.GetValue(1).ToString()); but i get an error in the second statmemt saying that "Index was outside the bounds of the array." — Victoria
– Victoria, Commented Jun 2, 2011 at 22:05

George Stocker · Accepted Answer · 2011-06-02 19:01:03Z

First off, one problem you're running into is SQL Injection. This has been written about many many many times, so I won't go too much into it here.

You want to change your SQL Query to use parameters, like so:

using (SqlConnection conn = new SqlConnection("Server=(local);DataBase=Northwind;Integrated Security=SSPI")
{

    SqlCommand cmd = new SqlCommand("SELECT Risk From HightAndWeightTable WHERE Hight LIKE '%" + @height + "%'", conn);

    SqlParameter param = new SqlParameter();
    param.ParameterName = "@height";
    param.Value = domainUpDown1.Text;

    cmd.Parameters.Add(param);

    reader = cmd.ExecuteReader();

    while(reader.Read())
    {
        //do something here:
        string risk = reader["Risk"];
    }
}

Also, are you spelling everything correctly in your query? It looks like you misspelled height.

As far as between:

SELECT thing t FROM table where t.value BETWEEN lowerLimit AND upperLimit

Tim · Accepted Answer · 2011-06-02 18:56:34Z

1

First, you don't want to use LIKE when comparing what I assume are numeric values. You can just do = or > or whatever is appropriate for your comparison.

Second, please please please, tell me that you're either doing validation on that user input or you're not really planning on using string concatenation to build your SQL Strings (use parameters!)

Third, range can be accomplished using the BETWEEN operator.

answered Jun 2, 2011 at 18:56

Tim

15.3k1 gold badge48 silver badges70 bronze badges

Collectives™ on Stack Overflow

Sql query in c#

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related