CODEWITHSUNDEEP
asp.netvb.net
D Infosystems
D Infosystems

Reputation: 524

What is wrong with my this code, i think the select query is wrong?

What is wrong with my this code, i think the select query is wrong :

i have a textbox1, textbox2 and textbox3

when i type employee id in textbox1 and Email in textbox2 then in textbox3 the password will be retrieved according to employee id and email in database... 

Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
            'Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT Password FROM a1_admins WHERE EmployeeId" = TextBox1.Text And "Email" = TextBox2.Text, SQLData)
            Dim SQLData As New System.Data.SqlClient.SqlConnection("Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\ASPNETDB.MDF;Integrated Security=True;User Instance=True")
            Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT Password FROM a1_admins WHERE EmployeeId =" & TextBox1.Text & "And" & "Email" = TextBox2.Text, SQLData)
            SQLData.Open()
            Dim dtrReader As System.Data.SqlClient.SqlDataReader = cmdSelect.ExecuteReader()
            If dtrReader.HasRows Then
                While dtrReader.Read()
                    TextBox3.Text = dtrReader("Password")
                End While
            Else
                TextBox3.Text = ("No customer found for the supplied ID.")
            End If

            dtrReader.Close()
            SQLData.Close()
        End Sub

Upvotes: 0

Views: 115

Answers (4)

codingbadger
codingbadger

Reputation: 43974

It would have been useful if you had posted the actual error message.

However, I think your SQL query is missing some spaces. It should be:

Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT Password FROM a1_admins WHERE EmployeeId = " & TextBox1.Text & " And " & "Email = '" & TextBox2.Text & "'", SQLData)

Edit

As pointed out in other answers you should really be using parameters. I have provided a link to the MSDN article on using Parameters with the SQLCommand class

Upvotes: 0

jb_
jb_

Reputation: 958

  1. Why not giving your controls proper names?
  2. Never ever build your query string by string concatination, use SqlParameter instead (Especially in a ASP.NET application!), to avoid sql injection.
  3. Maybe you want to use HttpServerUtility.HtmlDecode too, to avoid injection of javascript and other nasty stuff on postback.
  4. Use usings for disposable objects like SqlConnection and SqlDataReader
  5. Yeah its definitely your SQL. There have to be syntax errors, because the query string is not concatenate correctly.

Upvotes: 2

cjk
cjk

Reputation: 46415

You haven't got quotes around the values, nor added any extra whitespace.

Really your query should have parameters in:

SELECT Password FROM a1_admins WHERE EmployeeId = @employeeID And Email = @email

Upvotes: 1

KBoek
KBoek

Reputation: 5976

Try this (note the quotes) - assuming that EmloyeeId is an int and Email is some kind of varchar

Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT Password FROM a1_admins WHERE EmployeeId =" & TextBox1.Text & " And Email = '" & TextBox2.Text & "'", SQLData)

Upvotes: 0

Related Questions