VB.Net与MySQL问题？

Question

I am Searching and Block registration for duplicate ID from mysql Database using VB.Net 2010. I have got: you have an error in your sql syntax....

Please can you to help me in this? What will be the mistake i made? What will be the correct way?

Imports System.IO
Imports MySql.Data.MySqlClient
Imports System.Data.SqlClient

    Public Class Add_Clients
        Private Sub CheckClient()
            Dim myquery As String = ""
            Dim mycmd As MySqlCommand

            myquery = "select * from clients where client_id=" & clid.Text
            mycmd = New MySqlCommand(myquery, con)
            Dim idno As Integer = mycmd.ExecuteNonQuery()

            If idno < 0 Then
      MsgBox("The Client is already Exist!", MsgBoxStyle.Exclamation, "Car Rental System")
                Return
            End If

        End Sub

Answer 1

Your query should be like this...

 myquery = "SELECT * FROM clients WHERE client_id='" & clid.Text.Replace("'","''").Trim() & "'"

The additional .Replace("'","''").Trim() should protect you from SQL injection. This should work for now... But you later have you use parametized queries to avoid SQL hacks :) So for now, practice SQL statements first.

Answer 2

You should use a parameterized query. It simplifies the code while guarding against injection attacks.

myquery = "select * from clients where client_id=@clid" 
**mycmd = New MySqlCommand(myquery, con)**
mycmd.Parameters.AddWithValue("@clid", clid.Text);