CODEWITHSUNDEEP
asp.netvb.nett-sqlado.net
Sumit
Sumit

Reputation: 1

What's wrong in this SELECT query?

Dim cmdSelect As New SqlCommand("SELECT DISTINCT [seat_remain] FROM [a1_ticket] WHERE serv_code =" & lab5.Text & "ORDER BY [Ticket_no] DESC", SQLData)

Upvotes: 0

Views: 110

Answers (2)

Darin Dimitrov
Darin Dimitrov

Reputation: 1038710

You are using string concatenation for constructing your SQL query instead of parametrized queries or stored procedures. That's what is wrong with it. Here's how to improve it:

Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT DISTINCT [seat_remain] FROM [a1_ticket] WHERE serv_code = @serv_code ORDER BY [Ticket_no] DESC", SQLData)
cmdSelect.Parameters.AddWithValue("@serv_code", lab5.Text)

Now your query will work and not only this but it is safe against SQL injection.

Upvotes: 8

Cyril Gandon
Cyril Gandon

Reputation: 17048

Missing quote :

Dim cmdSelect As New System.Data.SqlClient.SqlCommand("SELECT DISTINCT [seat_remain] FROM [a1_ticket] WHERE serv_code ='" & lab5.Text & "' ORDER BY [Ticket_no] DESC", SQLData)

Upvotes: 3

Related Questions