如何使用文本框中的输入并在C＃中的mysql查询中使用它

Question

Code:

string connString = "SERVER=;UID=;PASSWORD=;DATABASE=;";
MySqlConnection connect = new MySqlConnection(connString);
MySqlCommand myCommand = connect.CreateCommand();

string input = textBox4.Text;

myCommand.CommandText = "SELECT * FROM project WHERE Id = @input";
connect.Open();

MySqlDataReader reader = myCommand.ExecuteReader();

if (reader.Read())
   textBox1.Text = reader["Name"].ToString();

connect.Close();

I am trying to use data from a form textbox (textBox4) and pass that input into a mysql query.

The program works by the user inputting their id number and the form outputs their name into another textbox (textBox1).

When I use either the string 'input' or textBox4.Text itself I get an error message which is: "Fatal error encountered during command execution."

However if I manually type in a correct id number in the code itself it returns the correct vaule

New to C# and mysql sorry for any big errors.

Answer 1

Here is what I would do in your case:

string connString = "SERVER=;UID=;PASSWORD=;DATABASE=;";
MySqlConnection connect = new MySqlConnection(connString);
MySqlCommand myCommand = connect.CreateCommand();
string input = textBox4.Text;

myCommand.CommandText = "SELECT * FROM project WHERE Id = @input";
myCommand.Parameters.Add("@input", SqlDbType.Int).Value = Convert.ToInt32(textBox4.Text);
connect.Open();

MySqlDataReader reader = myCommand.ExecuteReader();

if (reader.Read())
   textBox1.Text = reader["Name"].ToString();

connect.Close();

As you can see in the example above I am doing two things:

1. Sanitizing the input by using a SqlParameter and,
2. Converting the value of "@input" to a number; which is the assumption based on your question.

Best of luck to you, and please continue learning!

Answer 2

You're almost there, actually. You're using a parameter ( @input ) and not concatenating strings ( "select .. " + text + " from ..." ), which is wrong for many reasons.

Just tell your command how to replace that parameter. I guess it's something like this (not sure for MySQL):

myCommand.Parameters.Add("@input", SqlDbType.Int).Value = Convert.ToInt32(textBox4.Text);

Note that I'm assuming that Id is of type SqlDbType.Int . You may change it accordingly.

You must do this before calling myCommand.ExecuteReader() . Most likely, you'll put this line after myCommand.CommandText = "..."; .