c# - Populating Values For DataGridView from DataBase based on the condition -


"itemprop =" text ">

I am creating an application where I want to display the rows in the DataGridView on the basis the user entered in the value text box.

For example.

I have used the following codings: User text box is all that should be displayed in a DataGridView of information about this book,

 < Code> SqlConnection objSqlConnection = New SqlConnection (); String Connection StringSettings = "Data Source = Initial Catalog = LibrarySystemManagement; Integrated Security = SSPI"; Private Zero btnSearch_Click (Object Sender, EventArgs e) {objSqlConnection.ConnectionString = connectionStringSettings; ObjSqlConnection.Open (); If ((txtBookName.Text! = "") || (txtCategory.Text! = "")) {SqlDataAdapter objSqlDataAdapter = new selection SqlDataAdapter ( "LIBRARYBOOKDETAILS * where title = '' + txtTitle.Text +" ' ", objSqlConnection ); SqlCommandBuilder objSqlCommandBuilder = new SqlCommandBuilder (objSqlDataAdapter); Datatabl objDataTable = new Detatale (); objSqlDataAdapter.Fill (objDataTable); binding source objBindingSource = new binding process (); ObjBindingSource.DataSource = objDataTable; DataGridView1.DataSource = objBindingSource; objSqlDataAdapter. Update (objDataTable); objSqlConnection.Close ();}} Hold (Exception E1) {Message Box. Show (e1.Message + e1.Source);}  

But the above code table All lines entered in I mean that the rows have not been retrieved on the basis of the situation.

Does anyone have the code to use to recover data based on this situation Can you help me find the right set of snippets?

Please help me.

Thanks in advance.

You are opening up the SQL injection while accepting user input directly, although this is a The side is the issue Why are you calling objSqlDataAdapter.Update (objDataTable); in this section

Although everything looks fine I will try 2 things:?

  1. Remove

    objSqlDataAdapter.Update (objDataTable); Call - Nothing has been modified, so what is being updated? At this point you should select only the data. When this update is made, the table is also modified, and the table acts as the data source of your BindingSource.

  2. Use the parameter and see that it does not make a difference to select the order change. Of

      SqlDataAdapter objSqlDataAdapter = new SqlDataAdapter ( "Select * This step SQL injection has the added benefit of preventing    

    This change. LIBRARYBOOKDETAILS where title = ' "+ txtTitle.Text +"' ', objSqlConnection);

    to:

      SqlCommand command = new SqlCommand ( "Select from LIBRARYBOOKDETAILS, where title = @Title", objSqlConnection); order. parameters. AddWithValue ( "@ title", txtTitle.Text); SqlDataAdapter objSqlDataAdapter = new SqlDataAdapter (command);  

Comments

Post a Comment

Popular posts from this blog

c++ - Linux and clipboard -

What is expire header and how to achive them in ASP.NET and PHP? -

sql server - How can I determine which of my SQL 2005 statistics are unused? -