C＃中的数据库访问

Question

I am trying to access database in c# but i am getting runtime error.code is below

public void value_assign()
{
    SqlConnection conn;
    String admission_no = adm_text.Text;
    string connectionstring = "server=AMAN;database=student;Integrated Security=True";
    string query1 = "select * from fees where Admission_no=" + admission_no;
    SqlDataReader rdr1;
    conn = new SqlConnection(connectionstring);
    conn.Open();
    SqlCommand cmd1 = new SqlCommand(query1, conn);
    rdr1 = cmd1.ExecuteReader();
    while (rdr1.Read())
    {
        prospectues_fee = (float)rdr1.GetValue(1);
        registration_fee = (float)rdr1.GetValue(2);
        admission_fee = (float)rdr1.GetValue(3);
        security_money = (float)rdr1.GetValue(4);
        misslaneous_fee = (float)rdr1.GetValue(5);
        development_fee = (float)rdr1.GetValue(6);
        transport_fair = (float)rdr1.GetValue(7);
        computer_fee = (float)rdr1.GetValue(8);
        activity = (float)rdr1.GetValue(9);
        hostel_fee = (float)rdr1.GetValue(10);
        dely_fine = (float)rdr1.GetValue(11);
        back_dues = (float)rdr1.GetValue(12);
        tution_fee = (float)rdr1.GetValue(13);
        tu_mon = rdr1.GetString(14);
        other_fee = (float)rdr1.GetValue(15);

        total = (float)rdr1.GetValue(16);
    }
    conn.Close();
}

I'm getting a runtime error in rdr1.executereader() . I'm using it connection database at other places also where it is working fine

Answer 1

This is the VERY QUICK AND HORRIBLY UNSAFE HACK:

The variable admission_no is a string. You need to to enclose it in quotes.

string query1 = "select * from fees where Admission_no='" + admission_no + "'";

However this approach leaves you wide open to SQL Injection attacks which is a massive risk.

A MUCH better approach (I can't stress this strongly enough) is to set your query string to

string query1 = "select * from fees where Admission_no=@admission_no";

and then add the parameter to the command:

SqlCommand cmd1 = new SqlCommand(query1, conn);
cmd1.Parameters.AddWithValue("@admission_no", adm_text.Text);
rdr1 = cmd1.ExecuteReader();