[Solved] Error when execute query [closed]

by


The roll number string in your where clause needs to be delimited as a string. This line query = query + " " + "WHERE rollNo=" + "2K12-BSCS-37"; should be replaced with query += " " + "WHERE rollNo=" + "'2K12-BSCS-37'"; Note the single quotes.

Better still would be to use string format to build your query, something like this:

string.Format("SELECT * FROM dbo.[{0}_{1}] WHERE rollNo = '{2}'",
              session.SelectedItem.Text,
              dept.SelectedItem.Text,
              "2K12-BSCS-37")

And even better still would be to avoid this dangerous query altogether, since it exposes your database to numerous possible attacks. I have honestly never let users build their own table name in this fashion, so I can’t even say if the SQLClient parameters would work here, though I expect they will not. I agree with previous comments that much range checking, etc. will be required to make this viable.

In the end, hopefully this is an internal application that only a select few users will ever have access to.

2

solved Error when execute query [closed]