如何在where子句中传递参数？

Question

This is what i tried. But i am not getting any error as well as no output. what i did wrong. and why this query is not working.

SqlCommand cmd = new SqlCommand();
            cmd.Connection = con;
            cmd.CommandText = "SELECT balance FROM PersonalLoan_tb WHERE emp_id = '@term' AND paid_or_unpaid = '@Paid' ORDER BY Id DESC";
            cmd.Parameters.AddWithValue("@term", term);
            cmd.Parameters.AddWithValue("@Paid", paid);

But when i try with query without parameter i am getting output.

Answer 1

Don't use single Quotes ' in parameters of Query

SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "SELECT balance FROM PersonalLoan_tb WHERE emp_id = @term AND paid_or_unpaid = @Paid ORDER BY Id DESC";
        cmd.Parameters.AddWithValue("@term", term);
        cmd.Parameters.AddWithValue("@Paid", paid);

Answer 2

As per my comment - single quotes should not be there - they change the parameter to a literal. So your query is looking for a balance where the emp_id is the string '@term' and is won't be using the parameter passed in. Try

SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "SELECT balance FROM PersonalLoan_tb WHERE emp_id = @term AND paid_or_unpaid = @Paid ORDER BY Id DESC";
        cmd.Parameters.AddWithValue("@term", term);
        cmd.Parameters.AddWithValue("@Paid", paid);

Answer 3

Anything specified between single quote ('), will be considered as a string. So write parameter name without quote (') and it will work.

"SELECT balance FROM PersonalLoan_tb WHERE emp_id = @term AND paid_or_unpaid = @Paid ORDER BY Id DESC"

rest of the code will be same.

Answer 4

SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "SELECT balance FROM PersonalLoan_tb WHERE emp_id = @term AND paid_or_unpaid = @Paid ORDER BY Id DESC";
        cmd.Parameters.AddWithValue("@term", term);
        cmd.Parameters.AddWithValue("@Paid", paid);

Answer 5

First, you don't need the single quotes in the query string:

cmd.CommandText = "SELECT balance FROM PersonalLoan_tb WHERE emp_id = @term AND paid_or_unpaid = @Paid ORDER BY Id DESC";

That said, I caution you against using AddWithValue() . This must infer the types being passed into the string -- and any time code is not explicit, there is a danger of misinterpretation. Here , for instance, is a blog post explaining why this isn't a good idea.