c# - Database to declared variable -


i want pass studname contents declared variable. tried " +a.tostring+" still got errors

string a;  connection.close(); connection.open(); string strsql = "select *from students studname = '"  +a.tostring() + "' , studnum = '" + studentnumber; oledbcommand command = new oledbcommand(strsql); 

studnum = '" + studentnumber

the database column studentnumber numeric you're half treating alphanumeric.

solution

studnum = " + studentnumber

you need use parameterised commands protect against sql injection attack. solve issues such variables containing apostrophes , etc cause sql fail.


Comments

Popular posts from this blog

ios - RestKit 0.20 — CoreData: error: Failed to call designated initializer on NSManagedObject class (again) -

laravel - PDOException in Connector.php line 55: SQLSTATE[HY000] [1045] Access denied for user 'root'@'localhost' (using password: YES) -

java - Digest auth with Spring Security using javaconfig -