I have a problem filtering into my listview when having a select with multiple conditions.

Question

0.00/5 (No votes)

See more:

I have a listview which i will select from the list then if I click a row it will display in the form, labels (label5 (course),label9 (year) ,label10 (Section)).

Only this query works and it shows data but only filters by course, string Query9 = "select*from portal.student_table WHERE Course = '" + label5.Text + "';";

What I want is the list view will be filtered according to the course, year and the section.

When I tried this it does not show anything anymore it is always empty even though it has the correct data according to the labels.

This is the query which I think is correct but not working.

C#

string Query9 = "select*from portal.student_table WHERE Course = '" + label5.Text + "' and Year = '" + label8.Text + "' and Section = '" + label9.Text + "'";

What I have tried:

C#

public void gridview()
{
    listView1.Clear();
    string MyConnection9 = "server=localhost;username=root;";
    
    string Query9 = "select*from portal.student_table WHERE Course = '" + label5.Text + "' and Year = '" + label8.Text + "' and Section = '" + label9.Text +"';"; //this query is not working when i run it does not show anything in my listview.
    MySqlConnection Myconn9 = new MySqlConnection(MyConnection9);
    MySqlCommand MyCommand9 = new MySqlCommand(Query9, Myconn9);
    MySqlDataReader MyReader9;
    Myconn9.Open();
    MyReader9 = MyCommand9.ExecuteReader();

    while (MyReader9.Read())
    {
        ListViewItem lv = new ListViewItem(MyReader9.GetString(3));
        lv.SubItems.Add(MyReader9.GetString(12));
        lv.SubItems.Add(MyReader9.GetString(8));
        lv.SubItems.Add(MyReader9.GetString(9));
        lv.SubItems.Add(MyReader9.GetString(10));

        listView1.Items.Add(lv);
    }
    MyCommand9.Dispose();
    Myconn9.Close();

    listView1.View = View.Details;
    listView1.GridLines = false;
    listView1.Columns.Add("Student No.", 90);
    listView1.Columns.Add("Name", 170);
    listView1.Columns.Add("Course", 195);
    listView1.Columns.Add("Year", 90);
    listView1.Columns.Add("Section", 90);
}

private void listView3_SelectedIndexChanged(object sender, EventArgs e)
{
    if (listView3.SelectedItems.Count > 0)
    {
        ListViewItem item = listView3.SelectedItems[0];
        textBox2.Text = item.SubItems[3].Text;
        label5.Text = item.SubItems[4].Text;
        label8.Text = item.SubItems[5].Text;
        label9.Text = item.SubItems[6].Text;
    }
    else
    {
        textBox2.Text = string.Empty;
        label5.Text = string.Empty;
        label9.Text = string.Empty;
        label8.Text = string.Empty;
    }
}

private void label8_TextChanged(object sender, EventArgs e)
{
    gridview();
}

Posted 14-Jan-21 4:59am

Riva Nicole Calinawan

Updated 14-Jan-21 8:20am

Richard Deeming

v2

Add a Solution

Comments

Richard Deeming 14-Jan-21 11:35am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Riva Nicole Calinawan 14-Jan-21 11:46am

Does it work with label.text?

Richard Deeming 14-Jan-21 11:50am

It depends where the text comes from. But even if you're absolutely certain that the user has no way of altering the label text, you should still use parameters. Otherwise, when you modify the code in six months to update the label text based on user input, you'll forget to come back and fix the query, and your database will be wide open.

If you leave the vulnerability in your code, I hope you've got deep pockets - for example, TalkTalk were fined £400,000 for a SQLi vulnerability:
TalkTalk cyber attack – how the ICO’s investigation unfolded | ICO[^]

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Luc Pattyn · Answer 1 · 2021-01-14T08:20:00

Solution 1

I see a lot of "magic numbers" in your code:

label5.Text = item.SubItems[4].Text;
label8.Text = item.SubItems[5].Text;
label9.Text = item.SubItems[6].Text;

Try hard and avoid them, e.g. by choosing more relevant identifier names and using named constants.

And then you will be much less likely to repeat the mistake you've made here.

:)

PS: did you ever take a look at the content of Query9?

Posted 14-Jan-21 8:20am

Luc Pattyn

Comments

Riva Nicole Calinawan 14-Jan-21 21:17pm

I already changed the identifier.

This query works

string Query9 = "select*from portal.student_table WHERE Course = '" + program.Text + "' AND Year = '" + Year.Text + "';";

But when having 2 AND Conditional statements it does not work, it does not show any data in the listview. This is the query.

string Query9 = "select*from portal.student_table WHERE Course = '" + program.Text + "' and Year = '" + Year.Text + "' and Section = '" + Section.Text + "'";

Luc Pattyn 14-Jan-21 22:09pm

Did you check what is inside your query string?
Is Year a numeric or a textual field? and Section?
Why do you have a ";" in the one query and not in the other?

suggestion: as long as it doesn't work, add a textbox (or label) that permanently displays your query string and set it before you execute the query. Make sure to use a monospaced font such as Courier New.