searching in database with parameters and textbox search

Question

0.00/5 (No votes)

See more:

hi guys,
i have a search form, which function is to search from database and show results in gridview, in this there are two boxes one is textbox and second is combobox, now in this one has to enter something in textbox and then select appropriate parameters from combobox as combobox is having some parammeters like name RollNo etc, and then the press search button for results. now issue m facing is, i am not able to use parameters of combobox and textbox together, means the search button should be able to check both boxes and then give results accordingly

C#

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;


namespace testingdatabase
{
    public partial class Form3 : Form
    {
        public Form3()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            new Form1().Show();
            this.Close();
        }

        private void text_searchstring_TextChanged(object sender, EventArgs e)
        {
            
        }

        private void button1_search_Click(object sender, EventArgs e)
        {
            text_searchstring + comboBox1.SelectedItem.ToString();
            errorProvider1.Dispose();
            //if (.Text.Length == 0)
            if (text_searchstring.Text.Length == 0)
                errorProvider1.SetError(text_searchstring, "please fill name");

            {
                SqlConnection conn = new SqlConnection();
                conn.ConnectionString = @"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Documents and Settings\jumbo\my documents\visual studio 2010\Projects\testingdatabase\testingdatabase\Database1.mdf;Integrated Security=True;User Instance=True";
                conn.Open();
                //SqlCommand cmd = new SqlCommand();
                //cmd.Connection = conn;
                //cmd = new SqlCommand("select * from Table where name like '%" + txtsearch.Text + "%'");
                //cmd = new SqlCommand("select * from Table1 where name like '%" + text_searchstring.Text + "%'");
                SqlDataAdapter adapter = new SqlDataAdapter("select * from Table1 where Name like '%" + text_searchstring.Text + "%'" , conn);
                DataTable dt = new DataTable();
                //SqlDataAdapter adapter = new SqlDataAdapter();
                adapter.Fill(dt);
                dataGridView1.DataSource = dt;
                dataGridView1.Visible = true;
                //dataGridView1.DataSource = dt;
                //dataGridView1.Visible = true;
                conn.Close();
                conn.Dispose();
            }
        }

        private void comboBox1_SelectedIndexChanged(object sender, EventArgs e)
        {
            SqlConnection myConnection_Company = new SqlConnection();
            myConnection_Company.ConnectionString = @"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Documents and Settings\jumbo\my documents\visual studio 2010\Projects\testingdatabase\testingdatabase\Database1.mdf;Integrated Security=True;User Instance=True";
            myConnection_Company.Open();
            SqlDataAdapter company = new SqlDataAdapter("select * from Table1 where Name like '" + comboBox1.SelectedItem.ToString() + "'", myConnection_Company);
            //DataTable dd = new DataTable();
            DataSet dd = new DataSet();
            company.Fill(dd);
            
                    text_searchstring.Text = "";
                
                myConnection_Company.Close();
                myConnection_Company.Dispose();
            } 

       private void groupBox1_Enter(object sender, EventArgs e)
       {

       }
    }
}

Posted 30-Jan-13 23:17pm

jangojan

Add a Solution

Comments

E.F. Nijboer 31-Jan-13 5:30am

Do you know Bobby Tables?
http://bobby-tables.com/

AdityaPratapSingh 31-Jan-13 5:49am

what you exactly want to do?

E.F. Nijboer 31-Jan-13 6:01am

You are concatenating strings to create a query string and is easily abused for sql injection. The comic of bobby tables illustrates this very nicely and is widely known to make this clear.

jangojan 1-Feb-13 0:35am

i mentioned in my question partap, actually i want to give some input in textbox and select appropriate parameter from the combobox the then give results according to the inpute and parameters. but it is not happening

AdityaPratapSingh 1-Feb-13 0:37am

ur problem still not solved

AdityaPratapSingh 1-Feb-13 0:39am

give me table structure in database

jangojan 1-Feb-13 0:35am

no i dnt know bobby tables

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Ksh_Sr · Answer 1 · 2013-01-30T23:34:00

Solution 1

try like this

C#

private void button1_search_Click(object sender, EventArgs e)
{
 string columname=comboBox1.SelectedText;
 string txttosearch= textbox1.Text;

 //Now rewrite ur query as 
"select * from Table1 where "+columnname+" like '%"+txttosearch+"%'"  

}

Rest whatevr you are doin is fine.
Just change query.

happy coding :)

Posted 30-Jan-13 23:34pm

Ksh_Sr

Comments

jangojan 1-Feb-13 0:36am

no it is not happening this time also, gives me no error, but when i input something in text box and select appropriate parameter from combobox the input in textbox disappear and press enter gives me error of sql adapter, so pleaase can you have look of code again,

jangojan 1-Feb-13 0:41am

private void text_searchstring_TextChanged(object sender, EventArgs e)
{

}

private void button1_search_Click(object sender, EventArgs e)
{
string Name = comboBox1.SelectedText;
string txttosearch = text_searchstring.Text;
//string parameter = text_searchstring + comboBox1.SelectedItem.ToString();
//string parameter = text_searchstring.Text + comboBox1.SelectedText.ToString();
//errorProvider1.Dispose();
//if (.Text.Length == 0)
//if (text_searchstring.Text.Length == 0)
// errorProvider1.SetError(text_searchstring, "please fill name");

{
SqlConnection conn = new SqlConnection();
conn.ConnectionString = @"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Documents and Settings\jumbo\my documents\visual studio 2010\Projects\testingdatabase\testingdatabase\Database1.mdf;Integrated Security=True;User Instance=True";
conn.Open();
//SqlCommand cmd = new SqlCommand();
//cmd.Connection = conn;
//cmd = new SqlCommand("select * from Table where name like '%" + txtsearch.Text + "%'");
//cmd = new SqlCommand("select * from Table1 where name like '%" + text_searchstring.Text + "%'");
SqlDataAdapter adapter = new SqlDataAdapter("select * from Table1 where "+Name+" like '%" +txttosearch+ "%'" , conn);
DataTable dt = new DataTable();
//SqlDataAdapter adapter = new SqlDataAdapter();
adapter.Fill(dt);
dataGridView1.DataSource = dt;
dataGridView1.Visible = true;
//dataGridView1.DataSource = dt;
//dataGridView1.Visible = true;
conn.Close();
conn.Dispose();

this time the code is like this . . please correct the code

jangojan 1-Feb-13 1:20am

ok i sendign you the cs page now

AdityaPratapSingh 1-Feb-13 3:33am

i didnt receive any code in my mail box