Unknown column "something" in 'where clause'

Question

My problem is always in throw. please help me to find the problem. thanks!

MySqlConnection cnn = new MySqlConnection(mysqladdress);

cnn.Open();

try
{
    MySqlCommand cmd = new MySqlCommand();
    cmd.Connection = cnn;
    cmd.CommandText = "SELECT * FROM info where StudentID ='" + textBox1.Text + "'and Name='" + textBox2.Text + "'";
    MySqlDataReader reader = cmd.ExecuteReader();

    int count = 0;
    while (reader.Read())
    {
        count = count + 1;
    }

    if (count == 1)
    {
        MessageBox.Show("Welcome");
    }
    else if (count > 1)
    {
        MessageBox.Show("Access Denied");
    }
    else
    {
        MessageBox.Show("Wrong student ID and Password");
    }

}
catch (Exception)
{
    throw;
}

Please read this: http://stackoverflow.com/questions/601300/what-is-sql-injection — DavidG, Sep 21 '16 at 14:26
What DavidG said. Also, .NET specific: https://msdn.microsoft.com/en-us/library/ff648339.aspx — Cristian Lupascu, Sep 21 '16 at 14:27
You need a space between the single quote and the word 'and' — jdweng, Sep 21 '16 at 14:28
Is it possible that in `textBox1` you entered the value `'; select * from table where Something=5; --` ? — Cristian Lupascu, Sep 21 '16 at 14:32

fubo · Answer 1 · 2016-09-21T14:56:26.473

2

This must be a typo or something simple which is hard to tell without knowing the exact error message.

To avoid such errors i would recommend you to use parameters:

cmd.CommandText = "SELECT * FROM info where StudentID = @StudentID and Name= @Name";
cmd.Parameters.Add("@StudentID", SqlDbType.VarChar).Value = textBox1.Text;
cmd.Parameters.Add("@Name", SqlDbType.VarChar).Value = textBox2.Text;

edited Sep 21 '16 at 14:56

answered Sep 21 '16 at 14:27

fubo

39,783
16
92
127

Unknown column "something" in 'where clause'

1 Answers1