Click here to Skip to main content
15,896,118 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C#
private void button3_Click(object sender, EventArgs e)
{
            checkGrid = "Due";

            dueDate DD = new dueDate();

            DD.ShowDialog();

            GlobalClass GC = new GlobalClass();

            DateTime vdateFrom = GC.getDueDateFrom();
            DateTime vdateTo = GC.getDueDateTo();

            string getAllData = "Select P_Id,P_Password,Format(Treat_Due_Date,\"'dd/MM/yyyy'\") As DueDate,P_Name,P_City,medicineTaker from patient_Details,Treatment_Details Where patient_Details.P_ID = Treatment_Details.Treat_P_ID AND Treat_Due_Date >= #" + vdateFrom.ToString("dd/MM/yyyy") + "# AND Treat_Due_Date <= #" + vdateTo.ToString("dd/MM/yyyy") + "#";

            bindGrid(getAllData);            
            
}
Posted
Updated 27-Mar-15 23:36pm
v3
Comments
[no name] 28-Mar-15 5:37am    
Question is not clear..

1 solution

Start by not concatenating strings to form your SQL command - not only is is generally dangerous (though not in this case) it also causes problems, particularly with date values. You should always use parameterized values instead.

The problem is that SQL doesn't not know what date format you are passing it - so it "guesses" and frequently it guesses wrong. Passing your dates as parameters avoids all that - as well as being better practice, and more efficient.
So use the DateTime values directly, and pass them as parameters - it should cure your problem.
 
Share this answer
 
Comments
MayankSemwal 28-Mar-15 5:52am    
can you tell me how it would be done.. because i am kind a new.
OriginalGriff 28-Mar-15 6:12am    
I can't be specific because I have no idea how your bindGrid method works - but you will need to alter that to access parameter values.

I assume that means that all your other database access code also concatenates strings? If so, then stop what you are doing and fix that *now*. If you don't, then anyone with access to your application can damage or delete your database just by typing into textboxes. Lookup "SQL Injection" and you will see what I mean. Fix that first!

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900