How to fill datagridview when item selected from listbox

Question

1.00/5 (1 vote)

See more:

I wont to fill datagridview when item is selected from listbox
i write code but it gives me this error

Operator '&' is not defined for string "SELECT DeptName FROM  Department" and type 'DataRowView'.

VB

What I have tried:

this my code

Private Sub ListBox1_SelectedIndexChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ListBox1.SelectedIndexChanged
        cmd = New OleDbCommand("SELECT DeptName FROM  Departments inner  JOIN Faculties ON Faculties.ID = Departments.FacID where FacID='" & ListBox1.SelectedValue & "'", conn)
        Dim daa As New OleDbDataAdapter(cmd)
        Dim dtt As New DataTable
        daa.Fill(dtt)
        dgv.DataSource = dtt
    End Sub

Posted 10-Apr-17 4:30am

NebroProg

Add a Solution

Comments

CHill60 10-Apr-17 10:32am

Use OleDbParameters instead of concatenated strings (which you should NEVER use) and your problem will go away

NebroProg 10-Apr-17 10:37am

ok
I will be try
thnk's ^_^

Richard MacCutchan 10-Apr-17 10:34am

The string shown in your code does not match the string shown in your error message. But in either case you should not use string concatenation for SQL commands, use proper parameterised queries.

NebroProg 11-Apr-17 0:50am

when I pass parameter this error occur Conversion from type 'DataRowView' to type 'String' is not valid

kumar nitesh 11-Apr-17 2:32am

As per the error statement it looks like you are trying to convert your datagridrow to string . can you please show me your html code ??

Richard Deeming 11-Apr-17 14:21pm

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

NebroProg 13-Apr-17 8:52am

I know its vulnerable to sql injection ,it's desktop application

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)