下拉列表选择项

Question

I am trying to select a dynamic data from drop down list and view the details of selected items. I have no problem in populating the drop down list with data from database. However, when I selected some items, it does not shows up the detail.

In my presentation layer, when drop down list item is selected:

protected void ddlScheduleList_SelectedIndexChanged(object sender, EventArgs e)
    {
        string address = ddlScheduleList.SelectedItem.ToString();

        Distribution scheduledIndv = new Distribution();

        scheduledIndv = packBLL.getDistributionDetail(address);

        if (scheduledIndv == null)
        {
            Console.Out.WriteLine("Null");
        }
        else
        {
            tbScheduleDate.Text = scheduledIndv.packingDate.ToString();
            tbBeneficiary.Text = scheduledIndv.beneficiary;
        }

    }

In my business logic layer, I get the selected address and pass it to data access layer:

public Distribution getDistributionDetail(string address)
    {
        Distribution scheduledIndv = new Distribution();

        return scheduledIndv.getDistributionDetail(address);
    }

In my data access layer, I tested out the SQL statement already. It gives me what I wanted. But it just won't show up in web page.

public Distribution getDistributionDetail(string address)
    {
        Distribution distributionFound = null;

        using (var connection = new SqlConnection(FoodBankDB.GetConnectionString())) // get your connection string from the other class here
        {
            SqlCommand command = new SqlCommand("SELECT d.packingDate, b.name FROM dbo.Distributions d " +
            " INNER JOIN dbo.Beneficiaries b ON d.beneficiary = b.id " +
            " WHERE b.addressLineOne = '" + address + "'", connection);
            connection.Open();

            using (var dr = command.ExecuteReader())
            {
                if (dr.Read())
                {
                    DateTime packingDate = DateTime.Parse(dr["packingDate"].ToString());
                    string beneficiary = dr["beneficiary"].ToString();

                    distributionFound = new Distribution(packingDate, beneficiary);
                }
            }
        }
        return distributionFound;
    }

And my execute Reader method in another separated class:

 public static string connectionString = Properties.Settings.Default.connectionString;

    public static string GetConnectionString()
    {
        return connectionString;
    }

public static SqlDataReader executeReader(string query)
    {
        SqlDataReader result = null;

        System.Diagnostics.Debug.WriteLine("FoodBankDB executeReader: " + query);

        SqlConnection connection = new SqlConnection(connectionString);
        SqlCommand command = new SqlCommand(query, connection);
        connection.Open();
        result = command.ExecuteReader();
        connection.Close();

        return result;
    }

I wonder what went wrong. Is it about the (!IsPostBack) or?

Thanks in advance.

Answer 1

You found your mistake, but to avoid Sql Injection, modify your code like this:

    SqlCommand command = new SqlCommand("SELECT d.packingDate, b.name FROM dbo.Distributions d " +
                " INNER JOIN dbo.Beneficiaries b ON d.beneficiary = b.id " +
                " WHERE b.addressLineOne = @address", connection);

    command.Parameters.AddWithValue("@address", address);