What I want to do is to look for the text that is entered on textbox4 assigned to Valor and display if found, the below code is working but I want to use parametized queries (security reasons) and I don't know how to modify my existing code to get it done. (eg, 123-A)
I will look for "123-A" but in the current code I got an error of "invalid column A", the SQL column that I will be looking "123-A" is "ID_LALTest"
Try
' *--------search by Unique ID-------*
Dim CON As New SqlConnection
Dim DA As New SqlDataAdapter
Dim DS As New DataSet
Dim SQL As String
Dim Valor As String
Valor = TextBox4_SearchData_LALTest.Text
CON.ConnectionString = "not displayed"
CON.Open()
SQL = "SELECT ID_LALTest, LALTest_SeqRef_CH, LALTest_SeqRef_Year FROM LALTest WHERE ID_LALTest=@Valor"
DA = New SqlDataAdapter(SQL, CON)
DA.SelectCommand.Parameters.AddWithValue("@Valor", Valor)
DA.SelectCommand.ExecuteNonQuery()
DA.Fill(DS, 0)
If DS.Tables(0).Rows.Count > 0 Then
' *--------Found, Display Data Grid-------*
Label2_SearchData_LALTest.Visible = False
GridView2_SearchData_LALTest.Visible = True
GridView3_SearchData_LALTest.Visible = True
GridView1_SearchData_LALTest.Visible = False
Else
Label2_SearchData_LALTest.Text = "Record Not Found"
Label2_SearchData_LALTest.Visible = True
GridView2_SearchData_LALTest.Visible = False
GridView3_SearchData_LALTest.Visible = False
GridView1_SearchData_LALTest.Visible = False
End If
con.dispose()
Catch ex As Exception
MsgBox(Err.Description)
End Try
.Add(New SqlParameter With {.ParameterName = "@Valor", .SqlDbType = SqlDbType.VarChar, .Size = 50, .Value = Valor})
(change the.Size
to what it is in the database). – Andrew Morton Mar 6 '13 at 21:35