CODEWITHSUNDEEP
c#asp.net
Mohsinjan110
Mohsinjan110

Reputation: 137

Dropdownlist data not insert in query

I select the DropDownList value to insert in query but the value remains blank in query and due to empty value in where condition not any result outcome. I do with different tricks but remain empty

if (chkBoxChanl.Checked)
{
    sql += " and channelName = '" + ddlChannel.Text + "' ";
}
if (chkBoxDate.Checked)
{
    sql += " and transmissionDate_ between '" + tbFrom.Text + "' and '" + tbTo.Text + "'";
}
if (chkBoxProgrm.Checked)
{
    sql += " and programName ='" + ddlProgram.Text + "'";
}
if (chkBoxParty.Checked)
{
    sql += " and partiesName like '%" + ddlParty.SelectedValue + "%'";
}
if (chkBoxPerson.Checked)
{
    sql += " and personsName like '%" + ddlPerson.SelectedItem + "%'";
}
if (chkBoxProvince.Checked)
{
    sql += " and ProvinceName like '%" + ddlProvince.SelectedItem + "%'";
}
if (chkBoxCity.Checked)
{
    sql += " and CityName like '%" + ddlCity.Text + "%'";
}

Like

What can I do to add the selected value in query? Please help me!

I check that when I select the dropdownist values which come on first load then 2md time after press search button dropdownlist values empty and when I press search button it first run Page_Load function and if(!IspostBack) is execute then all dropdownlist selected values become empty which cause to empty values in where clause. Now I want that when I press search button dropdownlist values remain loaded which will resolve the issue to become enpty dropdownlist values. Please guide me further

Upvotes: 0

Views: 452

Answers (3)

Rzv.im
Rzv.im

Reputation: 1028

Build your sql query something like this :

public DataSet ExecuteDataSet(string text, SqlParameter[] paramList)
        {
            using (SqlCommand sqlCommand = new SqlCommand(text, sqlConnection))
            {
                if (paramList != null)
                {
                    foreach (var param in paramList)
                    {
                        sqlCommand.Parameters.Add(param);
                    }
                }
                SqlDataAdapter dataAdapter = new SqlDataAdapter(sqlCommand);
                DataSet dataSet=new DataSet();
                dataAdapter.Fill(dataSet);
                return dataSet;
            }
        }

Upvotes: 0

digaomatias
digaomatias

Reputation: 1194

You cannot concatenate your input field's values directly in your sql query. It makes your system vulnerable to Sql Injection. You should at least encode what you are retrieving from these fields before running such sql query. It is very important that you read this before going ahead.

After reading the above carefully, you can get the value of the selected item on your dropdown. You do this:

yourDropDown.SelectedItem.Value

If it does not return a value, that's probably because you didn't set any value in your dropdown. Remember to set it according to your datasource:

yourDropDown.DataValueField = "TheSourceFieldContainingTheValue";

Upvotes: 1

Mihai
Mihai

Reputation: 2760

First of all: you shouldn't concatenate parameters to queries in this way. You expose yourself to SQL injection attacks.

Sorry, new to stackoverflow. Didn't see the comment button

and 

programName =' mytext' OR 1 = 1; 
DROP Database

Comment anything else.

Upvotes: 1

Related Questions