Click here to Skip to main content
15,844,673 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
{"Fetch Error:Conversion failed when converting the varchar value 'Data Base' to data type int."}

What I have tried:

private DataTable GetData()
{
DataTable dt = new DataTable();
SqlConnection connection = new SqlConnection("Data Source=.;Initial Catalog=Quiz_system;Integrated Security=True");
try
{
connection.Open();
SqlCommand sqlCmd = new SqlCommand("Select question_no,question,op1,op2,op3,op4,correct_ans From tbl_question_bank where course_name='" + lblcorrect.Text.ToString() + "' and quiz_id='"+lblqid.Text+"'", connection);
SqlDataAdapter sqlDa = new SqlDataAdapter(sqlCmd);
sqlDa.Fill(dt);
}
catch (System.Data.SqlClient.SqlException ex)
{
string msg = "Fetch Error:";
msg += ex.Message;
throw new Exception(msg);
}
finally
{
connection.Close();
}
return dt;
}
Posted
Updated 13-May-17 16:04pm
Comments
[no name] 13-May-17 19:14pm    
How could you possibly have forgotten how to do this correctly since yesterday?
Why are you calling ToString on an object that is already a string? Does that even remotely make any sense to you?
The error message is perfectly clear. What is your actual question here?

1 solution

Never build an SQL query by concatenating with user inputs, it is named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability.
SQL injection - Wikipedia[^]
SQL Injection[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
Top Experts
Last 24hrsThis month


CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900