>I want button1_Click on Form1 to send a query using the textBox1.Text
>string
[quoted text clipped - 7 lines]
> string strOleDb = "Select * from ProjectTable WHERE (ProjectName LIKE
> 'textBox1.Text')";
The easiest -and not recommended- way to do it is to concatenate the text
to the query:
string strOleDb = "Select * from ProjectTable WHERE (ProjectName LIKE '" +
textBox1.Text + "')";
This would work, BUT it has the risk of suffering what is known as a "Sql
Injection attack": If a user enters in the textbox something that looks like
Sql, it would be executed at your server. It also has other problems, for
instance, if the Text were "O'Donell", the code would crash with a syntax
error due to the single quote.
The recommended way to pass the text is to parameterize the Sql Query:
string strOleDb = "Select * from ProjectTable WHERE (ProjectName LIKE ?)";
OleDbCommand cmd = new OleDbCommand(strOleDb, connection);
cmd.Parameters.AddWithValue("FirstParam", textBox1.Text);
Tim Sprout - 28 Jun 2007 15:11 GMT
> "Alberto Poblacion" wrote;
>
[quoted text clipped - 3 lines]
> OleDbCommand cmd = new OleDbCommand(strOleDb, connection);
> cmd.Parameters.AddWithValue("FirstParam", textBox1.Text);
Thank you!
-Tim Sprout
AlexS - 28 Jun 2007 16:56 GMT
Won't it accept Text = "'some'; drop table ProjectTable;"?
>> "Alberto Poblacion" wrote;
>>
[quoted text clipped - 9 lines]
>
> -Tim Sprout