ado.net - SQL line returning an syntax error -
i'm trying make datagrid view returns records user after today. column names correct. it's giving me error reading "incorrect syntax near '>'"
here code.
txtdate.text = datetime.today.tostring("dd-mm-yyyy"); sqlconnection conn = database.getconnection(); sqlcommand cmd = new sqlcommand("select * homecarevisit medicalstaffid=" + idbox1.text+"and scheduleddatetime=>"+txtdate , conn);
there few problems;
new sqlcommand("select * homecarevisit medicalstaffid=" + idbox1.text+"and scheduleddatetime=>"+txtdate , conn); you forgot space before and, , operator greater or equal >=, not =>;
new sqlcommand("select * homecarevisit medicalstaffid=" + idbox1.text+" , scheduleddatetime>="+txtdate , conn); also, you're not quoting strings you're injecting sql, need surround them ';
new sqlcommand("select * homecarevisit medicalstaffid='" + idbox1.text+"' , scheduleddatetime>='"+txtdate+"'" , conn); this query should run, will still vulnerable sql injection. should using parameters sql commands instead of building sql parameters strings.
Comments
Post a Comment