我的逻辑正确吗？ 我正在尝试从组合框（下拉列表）获取数据，并使用该数据在清单框中搜索和显示信息

Question

I keep getting this error whenever I do the search: Invalid column name 'datafromcombobox'

I tried hardcode the data in my SQL query and it works. Any idea what's wrong with my code?

Here's the code:

        string selectedMedication = cboMedicationType.SelectedItem.ToString();

        string strMedications = "SELECT medicationName FROM MEDICATION WHERE medicationType= (" + selectedMedication + ")";
        SqlCommand cmdMedications = new SqlCommand(strMedications, connection);

        connection.Open();
        SqlDataReader readMedications = cmdMedications.ExecuteReader();

        while (readMedications.Read())
        {
            string medicationVar = readMedications["medicationName"].ToString();
            clbMedication.Items.Add(medicationVar, true);

        }
        readMedications.Close();
        connection.Close();

Answer 1

I think you just forgot the quotes in your query. This should work :

string strMedications = "SELECT medicationName FROM MEDICATION WHERE medicationType=   ('" + selectedMedication + "')";

Answer 2

I would do it this way:

using (SqlCommand cmdMedications = new SqlCommand(strMedications, connection))
{
    string strMedications = "SELECT medicationName FROM MEDICATION WHERE medicationType = @selectedMedication;
    command.Parameters.AddWithValue("selectedMedication", cboMedicationType.SelectedItem.ToString());
    connection.Open();
    using (SqlDataReader readMedications = cmdMedications.ExecuteReader())
    {
        while (readMedications.Read())
        {
            string medicationVar = readMedications["medicationName"].ToString();
            clbMedication.Items.Add(medicationVar, true);
        }
    }
    connection.Close();
}

I changed several things:

• Always use parameterized queries. If you don't, you can be a victim of SQL Injection . I changed that in your code.
• It's usually better to use using in your code ( see this article ), because then you don't need to close or dispose objects--the using statements take care of that.
• As for your error, it's probably an error in your query, but my code should take care of that.

Let me know if I can clear up something else. I hope this helps!

PS I mostly typed this without debugging so there might be some small things you might have to tweak, but I thing you should get the gist of it.