Trying to pass database name and text to call a SQL command in different file

Question

I'm calling the following code:

public static bool checkDuplicateProducts(string item1, string item2)
{
    // new connection
    SqlConnection con = new SqlConnection(stringCon);

    // adapter query
    SqlDataAdapter sda = new SqlDataAdapter("SELECT * FROM '" + item1 + "' WHERE ProductCode='" + item2 + "'", con);

    DataTable dt = new DataTable();
    sda.Fill(dt);

    if (dt.Rows.Count >= 1)
    {
        return true;
    }
    else
    {
        return false;
    }
}

from this:

string tableName = "Product";
else if(Functions.checkDuplicateProducts(tableName, textBox2.Text) == true)
{
       MessageBox.Show("The id is already available", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
}

I get this error when doing so:

System.Data.SqlClient.SqlException: 'Incorrect syntax near ' Product '.'

TheGeneral · Accepted Answer · 2020-02-21 03:58:01Z

1

Your table shouldn't be single quoted i.e SELECT * FROM table_name

"SELECT * FROM '" + item1 + "'

Should be

"SELECT * FROM " + item1 + "

However, you should really be using parameterised queries in general, lest you be on the wrong end of an sql injection attack

edited Feb 21, 2020 at 3:58

answered Feb 21, 2020 at 3:48

TheGeneral

82.1k9 gold badges111 silver badges152 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user3173025 Over a year ago

I'm a noob, and yeah that is what i'm trying to do. so what i'm doing is correct yeah?

TheGeneral Over a year ago

@HasaraJayasinghe yes it should work if corrected. however try to use Parameterised queries. stackoverflow.com/questions/7505808/…

Malakiya sanjay · Accepted Answer · 2020-02-21 03:55:42Z

0

Select * from Table Name you Should by Not Accepted c# for the query in 'Table Name'

REPLACE THE CODE

  SqlDataAdapter sda = new SqlDataAdapter("SELECT * FROM " + item1 + " WHERE ProductCode='" + item2 + "'", con);

answered Feb 21, 2020 at 3:55

Malakiya sanjay

2082 silver badges12 bronze badges

Collectives™ on Stack Overflow

Trying to pass database name and text to call a SQL command in different file

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related