Compare date from database using parameters

string queryString = "SELECT SUM(skupaj_kalorij)as Skupaj_Kalorij  "
                + "FROM (obroki_save LEFT JOIN users ON obroki_save.ID_uporabnika=users.ID)"
                + "WHERE (users.ID= " + a.ToString() + ") AND (obroki_save.datum= @datum)";

            using (OleDbCommand cmd = new OleDbCommand(queryString,database))                                    
                {
                    DateTime datum = DateTime.Today;
                    cmd.Parameters.AddWithValue("@datum", datum);
                }
            loadDataGrid2(queryString);

      

I tried now with parameters. But I really don't know how to get it right. I've tried like this, but the datum parameter doesn't get any value (as per C #).

+2


a source to share


3 answers


try this:

database = new OleDbConnection(connectionString);
                database.Open();
                date = DateTime.Now.ToShortDateString();
                string queryString = "SELECT SUM(skupaj_kalorij)as Skupaj_Kalorij  "
                    + "FROM (obroki_save LEFT JOIN users ON obroki_save.ID_uporabnika=users.ID)" 
                    + "WHERE users.ID= " + a.ToString()+" AND obroki_save.datum= '" +DateTime.Today.ToShortDateString() + "'";
                loadDataGrid2(queryString);

      

when using with Date you should write like this:



select * from table where date = '@date'

      

I do not like

select * from table where date = @date

      

+3


a source


While posting a bug is usually helpful, I would venture to guess and say that you are getting a conversion error with your date.

You should really look at parameterizing your queries ...



You should read the following: http://www.aspnet101.com/2007/03/parameterized-queries-in-asp-net/

And if you can't figure it out, try changing your 'a' variable to '1; DROP TABLE clauses; - '(but only after backing up the database).

+1


a source


Perhaps you need to write your SQL string in the SQL dialect of the database you are using. In Jet / ACE SQL (which is what Access is using) the separator for date values ​​is #, so you need the following:

  obroki_save.datum= #" +DateTime.Today.ToShortDateString() + "#"

      

Of course, some data interface libraries translate these things for you, so this might not be a problem.

0


a source







All Articles