c# - SqlException was unhandled, incorrect syntax -


i have following problem when performing query on sqlserver management:

an unhandled exception of type ' system.data.sqlclient.sqlexception ' occurred in system.data.dll

additional information : incorrect syntax near ' u' .

the code follows:

public static alumno obtenerusuario(string usuarionumero)         {             //long id_int;             //id_int = convert.toint64(pid);             using (sqlconnection conexion = bdcomun.obtnerconexion())             {                  alumno pal = new alumno();                 sqlcommand comando = new sqlcommand(string.format("select id, nombre, apellido, usuario, cargo, celular, rfid, fecha_nac, estado, check_acceso, empresa_contratista alumnos id={0}", usuarionumero), conexion);                  sqldatareader reader = comando.executereader();                  while (reader.read())                 {                     pal.nombre = reader.getstring(1);                     pal.apellido = reader.getstring(2);                     pal.usuario = reader.getstring(3);                     pal.cargo = reader.getstring(4);                     pal.celular = reader.getstring(5);                     //pal.rfid = reader.getstring(6);                     pal.fecha_nac = reader.getstring(7);                     pal.estado = reader.getstring(8);                     pal.check_acceso = reader.getstring(9);                     pal.empresa_contratista = reader.getstring(10);                 }                 conexion.close();                 return pal;              }         }

the function: public static alumno obtenerusuario(string usuarionumero) comes from:

public static alumno obtenerusuario(string prfid)        {            int dato_numerico;            int informacion_de_estado_2 = 0;            while (prfid.contains(""))            {                prfid = "123456789012";             }            while (prfid.contains(""))            {                prfid = "123456789012";            }            while (prfid.contains("~"))            {                prfid = "123456789012";                  informacion_de_estado_2 = 1; // 1 = acceso denegado 0 = acceso permitido para el registro            }            while (prfid.contains("¢")) //¢            {                prfid = "123456789012";                  informacion_de_estado_2 = 1; // 1 = acceso denegado 0 = acceso permitido para el registro            }                 using (sqlconnection conexion = bdcomun.obtnerconexion())                {                     alumno palumno = new alumno();                      sqlcommand comando = new sqlcommand(string.format(                        "select id, nombre,  apellido, usuario, cargo, celular, rfid, fecha_nac, empresa_contratista alumnos rfid = {0}", prfid), conexion);                     ////try                    ////{                        sqldatareader reader = comando.executereader();                     //}                    //catch (exception exp)                    //{                    //    //  messagebox.show("por favor inicia registros para habilitar el control.", "iniciar registros", messageboxbuttons.ok, messageboxicon.information);                    //}                     while (reader.read())                    {                        palumno.id = reader.getstring(0);                        palumno.nombre = reader.getstring(1);                        palumno.apellido = reader.getstring(2);                        palumno.usuario = reader.getstring(3);                        palumno.cargo = reader.getstring(4);                        palumno.celular = reader.getstring(5);                        palumno.rfid = reader.getstring(6);                        palumno.fecha_nac = reader.getstring(7);                        palumno.empresa_contratista = reader.getstring(8);                        // palumno.fecha_nac = convert.tostring(reader.getdatetime(7));                     }                     conexion.close();                    return palumno;                 }              }

how can resolve problem?

appending parameters directly command text bad practice, make vulnurable sql injection. can add variable usuarionumero parameter this

sqlcommand comando = new sqlcommand("select id, nombre, apellido, usuario, cargo, celular, rfid, fecha_nac, estado, check_acceso, empresa_contratista alumnos id=@id"); cmd.parameters.addwithvalue("@id", usuarionumero );

this should solve problem escaping special characters inside usuarionumero in resulting sql


Comments

Post a Comment

Popular posts from this blog

c++ - Difference between pre and post decrement in recursive function argument -

i have following sample code used pre-decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(--c); cout << c << endl; return; } } this function give output input 4 : dp3 dp2 dp1 dp0 0 1 2 3 but when use post decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(c--); cout << c << endl; return; } } output goes in infinite loop dp4 can explain me in detail why happens ? this happens because function(c--) called same value of c , when finishes c decremented. recursively called, hence called same value no chance of return , hit stack overflow error. assume this, int x = 1, y = 0; y = x++ result y == 1 , x == 2. if y = ++x , bot x , y 2.
Read more

php - Nothing but 'run(); ' when browsing to my local project, how do I fix this? -

i added new project. made mistake in projectname.conf file in sites-available apache2, led me reinstalling apache2. after reinstalling , re-enabling projects on every page of every project .. <body> run(); </body> .. i've run composer update, restarted service, restarted pc, checked config files, tried disabling new project. there nothing in error log, , access.log: 127.0.0.1 - - [15/may/2015:01:40:47 +0200] "get / http/1.1" 304 181 "-" "mozilla/5.0 (x11; ubuntu; linux x86_64; rv:38.0) gecko/20100101 firefox/38.0" maybe i'm forgetting apache2 reinstall? don't think did different last time installed it. looks haven't setup php correctly. take @ this great guide , maybe you're forgetting link php config apache2.
Read more

php - How can I echo out this array? -

i don't know how go grabbing data in variable , put foreach loop. class tree{ private $info = array( array('name'=>'jim','state'=>'nu','company'=>'nu','phone'=>array('cell'=>'5615111111','office'=>'5611111111'),'email'=>array('primary'=>'exs@example.com','ex@there.com')), array('name'=>'joe smith','city'=>'phoenix','phone'=>'4805551111','email'=>'jsmith@some_email.com'), array('name'=>'john doe','city'=>'chandler','company'=>'doe co.','email'=>array('jdoe@gmail.com','personal'=>'email@email.com'),'phone'=>'6025550002') ); } if you're inside of class, can access private variable using $this->variablename . example, i
Read more