Checking Two textboxes in sql queries?

Question

1.60/5 (2 votes)

See more:

C#

String selQuery = "SELECT Id FROM MapDataImage WHERE Source='" + TextBox1.Text + "' Destination='"  +TextBox2.Text + ;";

i just made a code for check two textbox values?
is it okay?

Posted 10-Jul-13 4:42am

promod madushan

Updated 10-Jul-13 4:43am

v2

Add a Solution

Comments

[no name] 10-Jul-13 10:53am

No it is not okay. You are missing an "AND" or an "OR", a quote character and you are subjecting yourself to SQL injection attacks. The error message that you got would have told you.

4 solutions

Solution 1

C#

please modify your query 

see this 

String selQuery = "SELECT Id FROM MapDataImage WHERE Source='" + TextBox1.Text + "' and Destination='"  +TextBox2.Text + "'";

Posted 10-Jul-13 4:47am

maneavnash

Updated 10-Jul-13 20:06pm

v2

Comments

CHill60 10-Jul-13 13:36pm

There's no "AND" or "OR" in this either

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CHill60 · Accepted Answer · 2013-07-10T07:42:00

If your database is SQL then try

String selQuery = "SELECT Id FROM MapDataImage WHERE Source = @t1 AND Destination = @t2";
SqlCommand cmd = new SqlCommand(selQuery);
cmd.Parameters.Add("@t1", TextBox1.Text);
cmd.Parameters.Add("@t2", TextBox2.Text);

Other databases do similar things - you just need to change the SqlCommand to the appropriate object, and be aware that not all DBMS' allow for named parameters

Sheikh Muhammad Haris · Accepted Answer · 2013-07-10T15:37:00

If you want to match both values exactly, then use following

C#

String selQuery = "SELECT Id FROM MapDataImage WHERE Source='" + TextBox1.Text + "' AND Destination='"  +TextBox2.Text + "'";

but if you want to match value of any one text box, then use this

C#

String selQuery = "SELECT Id FROM MapDataImage WHERE (Source='" + TextBox1.Text + "' OR Destination='"  +TextBox2.Text + "')";

Teenustar · Accepted Answer · 2013-07-10T10:40:00

Solution 3

If the columns, 'source' and 'destination' are of datatype varchar then it is always better to use like in your Where clause

SQL

String selQuery = "SELECT Id FROM MapDataImage WHERE Source like '%" + TextBox1.Text + "%' or Destination like '%"  +TextBox2.Text + "%'";

Posted 10-Jul-13 10:40am

Teenustar

Updated 10-Jul-13 10:43am

v2

Comments

CHill60 10-Jul-13 17:38pm

I'd be interested to know why you consider it better to use "like" - I would have thought that a query written with wildcards would be considerably less performant than one that is explicit. Plus what if TextBox1.Text is something like "Finsbury"? Then the search would (incorrectly) also return "Finsbury Park" and "Finsbury Leisure Centre" etc etc

Teenustar 11-Jul-13 15:18pm

What if the user tries to type in "Fins", in that case he wouldnt get the expected result of Finsbury.

Teenustar 11-Jul-13 15:19pm

From a user perspective, I assume a search made using text value brings the result matching the search criteria, rather than bringing only the exact match. Just like the Google search. I haven’t used wildcards.

CHill60 12-Jul-13 14:42pm

'%' is a wildcard in sql - hence my comment. Fair comment from you on the 'Fins' bit - I suppose it depends the application. Thanks for your reply

Checking Two textboxes in sql queries?

4 solutions

Solution 2

Solution 4

Solution 1

Solution 3

Add your solution here

Preview 0

Checking Two textboxes in sql queries?

4 solutions

Solution 2

Solution 4

Solution 1

Solution 3

Add your solution here

Preview 0

Existing Members

...or Join us