Changing label text from a database from a dropdownlist selection C#

Question

1.00/5 (1 vote)

See more:

I am trying to change a labels text based on what the users selects from a dropdownlist which is populated from a sql server. The labels text should be the result of a query which is called when the users select something from the dropdownlist. The lists are pretty long.

Example
User selects that their job title is a janitor from the dropdownlist.
The label changes the the office code number of what a janitor should be.

Users selects: Janitor
Label changes to code: 54684.

What I have tried:

using (SqlConnection conn = new SqlConnection("Database connection"))
                
{string myqueryconvt = "Select Office_Symbols FROM Office_Symbol_ID WHERE Office_Names = '" + ddlOfficeSymbolConvt.Text + "';";
SqlCommand cmd1 = new SqlCommand(myqueryconvt, conn);

lblOffice_SymbolsCovnt.Text = //???? I'm not sure what to call from this point If this is even correct.

Posted 4-Jun-19 6:32am

NeoAer

Updated 5-Jun-19 14:16pm

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

RickZeeland · Answer 1 · 2019-06-04T07:07:00

Solution 1

You can use the ExecuteScalar method, see example here: Obtaining a Single Value from a Database | Microsoft Docs[^]

Posted 4-Jun-19 7:07am

RickZeeland

Richard Deeming · Answer 2 · 2019-06-05T14:17:00

Quote:

C#

"Select Office_Symbols FROM Office_Symbol_ID WHERE Office_Names = '" + ddlOfficeSymbolConvt.Text + "';"

Not like that!

Your code is almost certainly vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

C#

using (SqlConnection conn = new SqlConnection("Database connection"))
using (SqlCommand cmd = new SqlCommand("Select Office_Symbols FROM Office_Symbol_ID WHERE Office_Names = @Office_Names;", conn))
{
    cmd.Parameters.AddWithValue("@Office_Names", ddlOfficeSymbolConvt.Text);
    
    conn.Open();
    
    object result = cmd.ExecuteScalar();
    if (Convert.IsDBNull(result))
    {
        lblOffice_SymbolsCovnt.Text = string.Empty;
    }
    else
    {
        lblOffice_SymbolsCovnt.Text = Convert.ToString(result);
    }
}