Click here to Skip to main content
15,843,142 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
create table test
(
a varchar(10),
b datetime,
c varchar(100),
d varchar(100),
e varchar(100),
f varchar(100)
)
insert into test VALUES( '1111','2014-10-28','SREERAM INDUSTRIES','OXYGEN','111','NOS')
insert into test select '1111','2014-11-02','M/S JANARDHAN OXY WELD SERVICE','BPCL CUTTING GAS','111','NOS'
In that about two i selected a column and loaded in drop downlist in asp.net(front end)
using the following query but in same both two nos are loaded but selecting in one record it shows same result to both records .it shows latest updated rows for two records. i want if i select i records that records sholud need to display.
SQL
select  *  from test where a ='" & DropDownList2.Text & "' order by cylinder_no asc
Posted
Updated 10-Nov-14 7:04am
v3
Comments
Richard Deeming 10-Nov-14 12:08pm    
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

1 solution

In this case you need find column which having unique values or multiple columns which together behave unique. for example you can combine a column and b column then it will give a unique value which help you to identify rows uniquely.

When binding you can set both display and value members. As value member you can bind b column value.

then you can change the select statement as below
SQL
"select  *  from test where a =@ddlText and b  =@ddlVal order by cylinder_no asc"

To avoid sql injection attacks, you better use parameterized sql statements
set @ddlText parameter value as DropDownList2.Text and @ddlVal parameter value as DropDownList2.SelectedItem.Value
 
Share this answer
 
v3

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900