尝试从 sql 数据库读取数据并显示在文本框上 - Visual C#（语法错误）

Question

edit: I'm aware of SQL Injection.

First of all, I know my coding methods are terrible but thats what I can for now, extremely beginner on c#.

I'm trying to read data from SQL server and show them on Textboxes. User going to write (and choose from cmbbox) some data on;

cmbIl.Text, cmbIlce.Text, cmbMahalle.Text, txtAda.Text, txtPafta.Text

and press the button for search.

If that data correspond to the values in sql database (true), some other data will be taken and shown at

txtTapuKodu.Text, txtPafta.Text, txtTapuAlani.Text, txtNitelik.Text, rtxtImarDurumu.Text

But the code below gives that error:

System.Data.SqlClient.SqlException: 'Incorrect syntax near ','.'

 private void btnSorgula_Click(object sender, EventArgs e)
        {
            string source = @"Data Source=YAGIZ-PC;Initial Catalog=imar_sorgu;Integrated Security=True";
            SqlConnection con = new SqlConnection(source);
            con.Open();

            string sqlSelectQuery = "SELECT * FROM tablo_arsa WHERE il = '" + cmbIl.Text + "', ilce = '" + cmbIlce.Text + "', mahalle = '" + cmbMahalle.Text + "', ada = '" + txtAda.Text + "', parsel = '" + txtParsel.Text + "'";

            /* string sqlSelectQuery2 = "SELECT * FROM tablo_arsa WHERE ilce ='" + cmbIlce.Text + "'";
            string sqlSelectQuery3 = "SELECT * FROM tablo_arsa WHERE mahalle ='" + cmbMahalle.Text + "'";
            string sqlSelectQuery4 = "SELECT * FROM tablo_arsa WHERE ada = " + txtAda.Text;
            string sqlSelectQuery5 = "SELECT * FROM tablo_arsa WHERE parsel = " + txtParsel.Text; */

            SqlCommand cmd = new SqlCommand(sqlSelectQuery, con);
            SqlDataReader dr = cmd.ExecuteReader();
            if (dr.Read())
            {
                txtTapuKodu.Text = (dr["tapu_kodu"].ToString());
                txtPafta.Text = (dr["pafta"].ToString());
                txtTapuAlani.Text = (dr["tapu_alani"].ToString());
                txtNitelik.Text = (dr["nitelik"].ToString());
                rtxtImarDurumu.Text = (dr["imar_durumu"].ToString());

                MessageBox.Show("İstek başarıyla okundu.");

            }
            else
            {

                MessageBox.Show("Okuma başarısız.");
            }
            con.Close();
        }

Answer 1

The problem is that your where clause contains commas between the predicates. use AND instead.

change:

    string sqlSelectQuery = "SELECT * FROM tablo_arsa WHERE il = '" + cmbIl.Text + "', ilce = '" + cmbIlce.Text + "', mahalle = '" + cmbMahalle.Text + "', ada = '" + txtAda.Text + "', parsel = '" + txtParsel.Text + "'";

to:

    string sqlSelectQuery = "SELECT * FROM tablo_arsa WHERE il = '" + cmbIl.Text + "' AND ilce = '" + cmbIlce.Text + "' AND mahalle = '" + cmbMahalle.Text + "' AND ada = '" + txtAda.Text + "' AND parsel = '" + txtParsel.Text + "'";

However, PLEASE read about SQL INJECTION. It is a very bad security issue and this is a perfect example.