SqlCommand AddWithValue

Question

SqlCommand command = new SqlCommand("SELECT * FROM users WHERE Username =  ? AND Password = ?", connection);
command.Parameters.AddWithValue("Username", username);
command.Parameters.AddWithValue("Password", password);
SqlDataReader reader = null;
reader = command.ExecuteReader();

When I run the program I get

Incorrect syntax near '?'.

On this line:

reader = command.ExecuteReader();

Can anyone see what I´m doing wrong?

is the query being run on SQL Server.. and if so what version..? is this just a standard Query or is this run against a StoredProcedure.. if it's a stored procedure.. change the "Username" to be "@Username" and "Password" to be "@Password" — MethodMan
– MethodMan, Commented Jan 17, 2012 at 14:13

Oleg Dok · Accepted Answer · 2012-01-17 14:12:37Z

9

using(SqlCommand command = new SqlCommand("SELECT * FROM users WHERE Username =  @Username AND Password = @Password", connection))
{
  command.Parameters.AddWithValue("@Username", username);
  command.Parameters.AddWithValue("@Password", password);
  using(SqlDataReader reader = command.ExecuteReader())
  {
    while(reader.Read())
    {
      //do actual works
    }
  }
}

Improved with using keywords, which is not necessary, but recommended

answered Jan 17, 2012 at 14:12

Oleg Dok

21.9k4 gold badges48 silver badges55 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Lloyd Over a year ago

Well worth adding... if ((reader.HasRows) && (reader.Read())) { }

user1228 Over a year ago

@Lloyd: Its not necessary. If reader.HasRows() returns false, so will reader.Read().

user1228 · Accepted Answer · 2012-01-17 14:13:55Z

1

SqlCommand command = new SqlCommand(
    "SELECT * FROM users WHERE Username = @Username AND Password = @Password",
    connection);
command.Parameters.AddWithValue("Username", username);
command.Parameters.AddWithValue("Password", password);
SqlDataReader reader = null;
reader = command.ExecuteReader();

You might want to read up on sql.

answered Jan 17, 2012 at 14:13

user1228

2 Comments

John Henckel Over a year ago

So... the @ sign is optional in the AddWithValue?

user1228 Over a year ago

@JohnHenckel Yep. Works with or without.

Justin Niessner · Accepted Answer · 2012-01-17 14:14:05Z

1

Which DBMS are you using? If you're using SQL Server, that is incorrect syntax for the query. You need:

SqlCommand cmd = 
    new SqlCommand(@"select * 
                     from users 
                     where username = @username and password = @password");

command.Parameters.AddWithValue("@username", username);
command.Parameters.AddWithValue("@password", password);

answered Jan 17, 2012 at 14:14

Justin Niessner

246k40 gold badges416 silver badges546 bronze badges

Collectives™ on Stack Overflow

SqlCommand AddWithValue

3 Answers 3

2 Comments

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related