CODEWITHSUNDEEP
c#sql-serverdatabasedatagridsql-injection
Lina
Lina

Reputation: 451

incorrect format for an int

I have a Form that contains 3 TextBox,a comboBox,and a DatagridView,in which a client tape an int for TextBox1 or a part of a Text in TextBox2 or TextBox3 or for more specification he can choose an item of the comboBox1 the result is displayed in the dataGridView(numeo_cpte,intitulé_cpte).My problem is I get northig of the result in the dataGridview and an erreur of conversion of the int =>the format of entered data is incorrect

this is my code:

private void button5_Click(object sender, EventArgs e)
        {   
            int a =Convert.ToInt32(textBox1.Text); //format of enetered data is incorrect
            String b = textBox3.Text;
            String c = comboBox1.SelectedItem.ToString();
            String d = textBox4.Text;

            SqlConnection connection = new SqlConnection(connectionString);
            connection.Open();
            req="select numero_cpte,intitulé_cpte from compte where numero_cpte='"+a+"' OR intitulé_cpte like '%"+b+"%' OR type_cpte='"+c+"' OR index_full_text_cpte like'%"+d+"%';";       
            SqlCommand sql = new SqlCommand(req,connection); 
            int o = sql.ExecuteNonQuery();
            MessageBox.Show(o + " succès");
            dr = new SqlDataAdapter(req, connection);
            dr.Fill(ds, "compte");
            compteDataGridView.DataSource = ds.Tables["compte"];
            connection.Close();

I add the line 

        int n=0;
        int a =int.TryParse(textBox1.Text,out n)?n:0;

and this is what I get,no errors but I didn't get any result displayed in the datagridView:

enter image description here

I made "success" just for test thanks again for your help

Upvotes: 3

Views: 784

Answers (4)

Ajay2707
Ajay2707

Reputation: 5798

Are you check your direct query with this parameter given result(s) like

--Replace the value with actual value
select numero_cpte,intitulé_cpte from compte where numero_cpte=cast(123 as int) OR intitulé_cpte like '%abc%' OR type_cpte='ddd' OR index_full_text_cpte like'%dasdf%';";

Please add cast in your query and remove single quote(') near a paramater.

req="select numero_cpte,intitulé_cpte from compte where numero_cpte=cast("+a+" as int) OR intitulé_cpte like '%"+b+"%' OR type_cpte='"+c+"' OR index_full_text_cpte like'%"+d+"%';";

Upvotes: 1

apomene
apomene

Reputation: 14389

Add a try catch to handle any errors and log them as well :

StreamWriter sw=new StreamWriter(path,true);
private void button5_Click(object sender, EventArgs e)
        {  try
           { 
            int a = Int32.Parse(textBox1.Text);
            ///...
            }
            catch (Exception ex)
            {
               sw.WriteLine(ex.Message);
            }
         }

EDIT : As it been pointed pointed by most, it is most probably that your problem lies to the fact that Textbox1 is not feeded with a valid string represantion of integer. However in anycase, this conclusion must come up from an external log and not a crush of your program because it fails to handle the given exception.

Upvotes: 2

Ricky
Ricky

Reputation: 2374

Replace int a =Convert.ToInt32(textBox1.Text); from the below statements.

int n = 0;
int a = int.TryParse(textbox1.Text, out n)?n:0;

In the above case if textbox1.Text is a valid integer then you will get result in a else you will get 0.

Upvotes: 1

Porlune
Porlune

Reputation: 749

This error will occur if the string is not formatted as an integer. For example:

Convert.ToInt32("1")        // returns 1
Convert.ToInt32("1.1")      // is not in a recognizable format

You should try using a regular expression to apply some formatting first or use a try/catch statement. If you are still having trouble, could you set a debug break point at this position and provide us a copy of the offending string provided by textbox1.Text?

Hope this helps!

Upvotes: 2

Related Questions