Database query not executed properly

Question

3.00/5 (1 vote)

See more:

When i excute this query it works if am searching for `tbl_permits`.`bid` BUT when i use tbl_permits`.`company` it says Unknown column "whatever i was searching comes here in this qoutes"

"SELECT * FROM `tbl_permits` WHERE `tbl_permits`.`bid`=" & txtSearch.Text & " OR `tbl_permits`.`company`=" & txtSearch.Text & ";"

thanks in advance

Posted 24-May-11 22:56pm

joseph k

Add a Solution

2 solutions

Solution 3

You can also use like this

"SELECT * FROM tbl_permits WHERE bid='" & txtSearch.Text & "' OR company='" & txtSearch.Text & "'"

Posted 25-May-11 3:10am

Tarun Mangukiya

Comments

fjdiewornncalwe 25-May-11 9:39am

Injection attack waiting to happen here, but the answer is still valid within the scope of the question. I'm just commenting to add a little more support to the parameterized query suggested by Sandeep.

joseph k 27-May-11 3:29am

Thanks , working on all options

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sandeep Mewara · Accepted Answer · 2011-05-24T23:05:00

Solution 1

I am not sure why you put the table name and column names in single quote.
Try:

SQL

"SELECT * FROM tbl_permits WHERE tbl_permits.bid='" & txtSearch.Text & "' OR tbl_permits.company='" & txtSearch.Text & "'"

You were missing the single quotes around the searchtext values passed to query.

Further, I would suggest you to use 'parametrized query'. It will overcome lots of issues and is much cleaner and safer way to execute queries.

UPDATE: You should use parameterized query[^] with your command.

Posted 24-May-11 23:05pm

Sandeep Mewara

Updated 24-May-11 23:50pm

v2

Comments

Kim Togo 25-May-11 5:12am

Good answer about parametrized query, my 5.

joseph k 25-May-11 5:32am

Tell me about parametrized query. Where to start...

Sandeep Mewara 25-May-11 5:50am

Answer updated to start with.

joseph k 25-May-11 8:01am

You meant "Stored Procedures"?

Sandeep Mewara 25-May-11 9:43am

No. Stored Procedure is different. I meant Parameterized query only. If needed, just Google the magic words and see (In case you did not get from the link I shared.)

Espen Harlinn 25-May-11 16:37pm

Good effort, my 5

joseph k 27-May-11 3:30am

Thanks, will work on that