ado.net - SQL line returning an syntax error -


i'm trying make datagrid view returns records user after today. column names correct. it's giving me error reading "incorrect syntax near '>'"

here code.

txtdate.text = datetime.today.tostring("dd-mm-yyyy"); sqlconnection conn = database.getconnection(); sqlcommand cmd = new sqlcommand("select * homecarevisit medicalstaffid=" + idbox1.text+"and scheduleddatetime=>"+txtdate , conn); 

there few problems;

new sqlcommand("select * homecarevisit medicalstaffid=" +                 idbox1.text+"and scheduleddatetime=>"+txtdate , conn); 

you forgot space before and, , operator greater or equal >=, not =>;

new sqlcommand("select * homecarevisit medicalstaffid=" +                 idbox1.text+" , scheduleddatetime>="+txtdate , conn); 

also, you're not quoting strings you're injecting sql, need surround them ';

new sqlcommand("select * homecarevisit medicalstaffid='" +                 idbox1.text+"' , scheduleddatetime>='"+txtdate+"'" , conn); 

this query should run, will still vulnerable sql injection. should using parameters sql commands instead of building sql parameters strings.


Comments

Popular posts from this blog

assembly - 8086 TASM: Illegal Indexing Mode -

Java, LWJGL, OpenGL 1.1, decoding BufferedImage to Bytebuffer and binding to OpenGL across classes -

javascript - addthis share facebook and google+ url -