Click here to Skip to main content
15,886,199 members
Please Sign up or sign in to vote.
2.00/5 (3 votes)
See more:
C#
str = "select Total_Fee from newstd_termfee where termnum='" + comboBox3.Text.Trim() + "'and admin_no='" + txtadmin.Text + "'";
                    str1 = "select  (dueamount/2)  as 'second term' from newstd_termfee";
                    com = new SqlCommand(str, cn);
                    com1 = new SqlCommand(str1,cn);
                    SqlDataReader reader = com.ExecuteReader();
                    SqlDataReader r1 = com1.EndExecuteReader();
                    if (r1.Read())
                    {
                        txttermfee.Text = r1["second term"].ToString();
                    }
                    if (reader.Read())
                    {
                        txttotal.Text = reader["Total_Fee"].ToString();

                    }

                    cn.Close();
                    reader.Close();
                    r1.Close();
Posted
Updated 21-Oct-14 4:29am
v2
Comments
[no name] 30-Sep-14 20:11pm    
It means exactly what it says. EndExecuteReader requires you to pass a parameter, you are not, so you get the error.
Richard Deeming 21-Oct-14 10:38am    
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.
CHill60 21-Oct-14 10:43am    
Did you really mean to use EndExecuteReader? where are you starting the asynchronous read? You need to pass in the IAsyncResult from that call.

1 solution

There are a couple of problems here:
1) EndExecuteReader doesn't have a version that doesn't need a parameter: MSDN[^]
2) To use EndExecuteReader, you must first call BeginExecuteReader first: MSDN[^]
3) I don't think you meant EndExecuteReader at all - probably, you wanted ExecuteReader.
4) You can't issue a second command on the same connection while a reader is already open on it, so you would need two connections to work with two readers simultaneously.

[edit]
5) As Richard said: Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead. (Can;t believe I didn;t say that... :sigh:
[/edit]

[edit2]
Fix my c**k-up: It was Richard, not Wes...:O
[/edit2]
 
Share this answer
 
v3
Comments
Richard Deeming 21-Oct-14 11:26am    
"As Wes said"?!

I don't recall changing my name! :P
OriginalGriff 21-Oct-14 11:34am    
I changed it for you by deed poll? :blush:

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900