How to display specific database entries into a textbox on a WinForm application

后端 未结 3 1887
北荒
北荒 2021-02-06 19:39

UPDATE: Thanks everyone, the code was not the issue, although the information regarding SQL injection was useful, my issue was that I was using an older version of my database w

3条回答
  •  情话喂你
    2021-02-06 20:11

    Try this instead. Avoid building SQL statement dynamically the way you are doing it. You are opening your database to risks of SQL Injection. Used parameters insead.

    using (var connection = new SqlConnection("connection string"))
    {
        connection.Open();
        using (var cmd = new SqlCommand("SELECT * FROM Product WHERE ProductID=@MYVALUE", connection))
        {
            cmd.Parameters.Add("@MYVALUE", SqlDbType.VarChar).Value = textBox3.Text;
            SqlDataReader re = cmd.ExecuteReader();
    
            if (re.Read())
            {
                textBox4.Text = re["ProductTitle"].ToString(); // only fills using first product in table
                textBox5.Text = re["ProductPublisherArtist"].ToString();
                comboBox1.Text = re["ProductType"].ToString();
                textBox6.Text = re["Price"].ToString();
            }
            else
            {
                MessageBox.Show("Please enter a valid item barcode");
            }
        }
    }
    

提交回复
热议问题