in data set i have an error
Hai,
I want to display a selected title details in a grid view using data bind method,
using query string i pass the selected title to the grid view page but the error occurs in dataset like "invalid column name str(ie)selected titlename"
how to solve this error?
public void bind()
{
string str = Request.QueryString["titlename"];
string connectionstring = @"data source=System-7\sqlExpress;initial catalog=Project;User ID=sa;Password=as;";
SqlConnection con = new SqlConnection(connectionstring);
con.Open();
string query = "select title,suggestion,owner,date from topic1 where title=" + str;
SqlCommand cmd = new SqlCommand(query, con);
SqlDataAdapter da = new SqlDataAdapter(cmd);
DataSet ds = new DataSet();
da.Fill(ds);//I have an error in this line.
GridView1.DataSource = ds;
GridView1.DataBind();
con.Close();
}
Suthish NairPosted Dec 29, 2010, 11:23 AM
Subhendu DePosted Dec 29, 2010, 3:45 AM
string query = String.Format("select title,suggestion,owner,date from topic1 where title='{0}'",str);
OR
string query = "select title,suggestion,owner,date from topic1 where title='" + str + "'";
Again this is not good practice. It would open you application for SQL injection attacks. Try to use parameterized query or stored procedure.
Also if you use da.Fill(ds), then you dont need to open and close the connection. Internally it does that. But closing connection is always expected so check connection state before closing the connection.