I am attempting to change my code. I am in the process of learning while I code and many parts of my C#/ASP.Net application use LINQ to SQL and many parts use commands to directly access the sql database. I felt like I should standardize these, so I am changing over the LINQ to SQL code. I have a portion of the code that takes the finds one record based on a session variable and then populates the labels in my header with the sql query results. here is the code:
protected void Page_Load(object sender, EventArgs e)
{
var pinNum = MySession.Current.focusParcel;
if (pinNum != 0)
{
String sql = ConfigurationManager.ConnectionStrings["Recorder"].ConnectionString;
SqlConnection connection = new SqlConnection(sql);
connection.Open();
SqlCommand command = new SqlCommand("Select PARCEL, PIN_TXT, Owner, Address1, Address2, CSZ, ACRES, LEGAL, Active FROM[ParcelView] WHERE PARCEL = " + pinNum, connection);
SqlDataReader selectedParcel = command.ExecuteReader();
if (selectedParcel != null)
{
lblPIN_Num.Text = selectedParcel["PARCEL"].ToString();
lblPIN_TXT.Text = selectedParcel["PIN_TXT"].ToString();
lblDateTime.Text = DateTime.Now.ToString("MMMM dd, yyyy");
lblOwner.Text = selectedParcel["Owner"].ToString();
lblAddress1.Text = selectedParcel["Address1"].ToString();
lblAddress2.Text = selectedParcel["Address2"].ToString();
lblCSZ.Text = selectedParcel["CSZ"].ToString();
lblAcres.Text = string.Format("{0} Acres", selectedParcel["ACRES"]);
lblLegal.Text = selectedParcel["LEGAL"].ToString();
if (selectedParcel["Active"].ToString() == "A")
{
lblInactive.Text = " (ACTIVE)";
}
else
{
lblInactive.Text = " (INACTIVE)";
lnkAddDocument.Visible = false;
}
}
lblCurrentUser.Text = Page.User.Identity.Name;
connection.Close();
}
else
Response.Redirect("./ParcelSearch.aspx");
}
I am receiving the following error:
Invalid attempt to read when no data is present.
I know the SQL statement used will return a record when it is used directly into sql query of database.
Thanks in advance for any advice. Should I be concerned about the lack of consistency in accessing data across the application at all? If so, should I be converting everything to LINQ? Or converting everything away from LINQ? I klnow of the existence of MVC and know I should learn it and use it, but I am too far down the path to try to convert there right now.
Change
if (selectedParcel != null)
To
if (selectedParcel.Read())
You have to read a record in the data reader before you can start pulling data. Its a forward only cursor that starts off not pointing to a record. The Read() method advances the reader by 1 and returns true/false if it was successful.
Note that it is not necessary to call HasRows if use the code above. The if block will only be entered if there is a row, if there is not then Read returns false and the block is not entered.
Edit
There are many bad practices in your code.
Use parameterized sql!! This is the most important thing you can take away here!
Wrap your connections in using blocks to ensure the connection is ALWAYS closed.
Sql code changes
String sql = ConfigurationManager.ConnectionStrings["Recorder"].ConnectionString;
using(SqlConnection connection = new SqlConnection(sql))
using(SqlCommand command = new SqlCommand("Select PARCEL, PIN_TXT, Owner, Address1, Address2, CSZ, ACRES, LEGAL, Active FROM [ParcelView] WHERE PARCEL = #pinNum", connection))
{
command.Parameters.Add(new SqlParameter("#pinNum", SqlDbType.VarChar){Value = pinNum});
connection.Open();
using(SqlDataReader selectedParcel = command.ExecuteReader())
{
if (selectedParcel.Read())
{
/*code unchanged*/
}
}
/* 1 line code unchanged*/
}
Once you have executed the command you need to actually read the data :
SqlDataReader selectedParcel = command.ExecuteReader();
if (selectedParcel.HasRows)
{
selectedParcel.Read();
....
....
I recommend you use this format for your sqlDatareader instead, as it it will parse whether results have been retrieved or not, and will automatically dispose itself on exception:
using(SqlDataReader selectedParcel = command.ExecuteReader())
{
while (selectedParcel .Read())
{
//Assign label text to results
}
}
You should Read() the SqlDataReader.
protected void Page_Load(object sender, EventArgs e)
{
var pinNum = MySession.Current.focusParcel;
if (pinNum == 0)
Response.Redirect("./ParcelSearch.aspx");
String sql = ConfigurationManager.ConnectionStrings["Recorder"].ConnectionString;
using(SqlConnection connection = new SqlConnection(sql))
{
connection.Open();
SqlCommand command = new SqlCommand("Select PARCEL, PIN_TXT, Owner, Address1, Address2, CSZ, ACRES, LEGAL, Active FROM[ParcelView] WHERE PARCEL =#PinNum ", connection);
//protect from sql injection
command.Parameters.AddWithValue(#PinNum, pinNum);
using(SqlDataReader selectedParcel = command.ExecuteReader())
{
if(!selectedParcel.HasRows)
return;
SetLabels(selectedParcel);
}
}
}
private void SetLabels(SqlDataReader selectedParcel)
{
lblPIN_Num.Text = selectedParcel["PARCEL"].ToString();
lblPIN_TXT.Text = selectedParcel["PIN_TXT"].ToString();
lblDateTime.Text = DateTime.Now.ToString("MMMM dd, yyyy");
lblOwner.Text = selectedParcel["Owner"].ToString();
lblAddress1.Text = selectedParcel["Address1"].ToString();
lblAddress2.Text = selectedParcel["Address2"].ToString();
lblCSZ.Text = selectedParcel["CSZ"].ToString();
lblAcres.Text = string.Format("{0} Acres", selectedParcel["ACRES"]);
lblLegal.Text = selectedParcel["LEGAL"].ToString();
if (selectedParcel["Active"].ToString() == "A")
{
lblInactive.Text = " (ACTIVE)";
}
else
{
lblInactive.Text = " (INACTIVE)";
lnkAddDocument.Visible = false;
}
lblCurrentUser.Text = Page.User.Identity.Name;
}
I refactor your code to look a little bit. You had different problems as not closing your Reader. You was open to sql injection, also you should transfer the connection to Db in separate class.
Related
I am trying to get the first result from my SQL table row. But I get the constraint by using the class to get the result.
I want to display supplier code by entering supplier email first like this.
Class Program
protected void Button_register_supplier_Click(object sender, EventArgs e)
{
string email_supplier = TextBox_email_supplier.Text;
c_supplier reg = new c_supplier();
reg.tampil_register(email_supplier);
Label_tampil_kode_user.Text = reg.tampil_register().ToString();
}
Class Supplier
public string tampil_register(string email_supplier)
{
SqlCommand command = new SqlCommand();
command.CommandText = "SELECT kode_supplier FROM tb_supplier WHERE email_supplier = #email_supplier";
command.Parameters.AddWithValue("#email_supplier", email_supplier);
command.CommandType = CommandType.Text;
command.Connection = con;
con.Open();
SqlDataReader dr = command.ExecuteReader();
string hasil;
while (dr.Read())
{
hasil = dr.GetValue(0).ToString();
return hasil;
}
}
So I will throw the value from my program class to supplier class to get the user code value. Then this user code will be displayed again in my program class by displaying it in my text label.
Your c_supplier class have a design flaw - you are using a class-level SQLConnection instance. This is a problem since it means you are not taking advantage of the built-in connection pool (and since it's implementing the IDisposable interface you are risking a memory leak). You should always use a local variable for SQLConnection, and dispose it as soon as possible. Also, you are using ExecuteReader when you need to use ExecuteScalar, and you are not disposing your SQLCommand instance as well.
A better code would be something like this:
public string tampil_register(string email_supplier)
{
using(var con = new SqlConnection(connectionString))
{
using(var command = new SqlCommand("SELECT kode_supplier FROM tb_supplier WHERE email_supplier = #email_supplier", con))
{
command.Parameters.Add("#email_supplier", SqlDbType.VarChar).Value = email_supplier;
con.Open();
var hasil = command.ExecuteScalar();
if(hasil != null && hasil != DBNull.Value)
{
return hasil.ToString();
}
}
}
return ""; // in case no record was found
}
That being said, you are also calling the tampil_register method twice - once with a string and once without - so your button click code should probably be:
protected void Button_register_supplier_Click(object sender, EventArgs e)
{
c_supplier reg = new c_supplier();
Label_tampil_kode_user.Text = reg.tampil_register(TextBox_email_supplier.Text);
}
I ran into another issue again. I was trying to get data from the database using DataReader but I got the error when i was testing my code. Can anyone help me out? The error occurred at this line:
chkAssess = readAssess[columnName].ToString();
Below is the code snippet:
public string CheckAssess(string emailAddress, string columnName)
{
string chkAssess = "";
SqlDataReader readAssess;
//readAssess = new SqlDataReader();
string MgrAssessQry = "SELECT '"+columnName+"' FROM tblAllUsers";
//MgrAssessQry += " WHERE email ='" + emailAddress + "'";
SqlCommand cmdReadAssess = new SqlCommand(MgrAssessQry, cn);
cn.Open();
readAssess = cmdReadAssess.ExecuteReader();
while(readAssess.Read())
{
// Add the rows
chkAssess = readAssess[columnName].ToString();
}
return chkAssess;
}
try to use column name without ''
select something from table
instead of
select 'something' from table
for security reasons, don't create sql queries in that way (by concatenating strings) - use #parameters instead
2. close the reader at the end
Try this:
public string CheckAssess(string emailAddress, string columnName)
{
string chkAssess = "";
SqlDataReader readAssess;
//readAssess = new SqlDataReader();
string MgrAssessQry = "SELECT #Column_Name FROM tblAllUsers";
SqlCommand cmdReadAssess = new SqlCommand(MgrAssessQry, cn);
cmdReadAssess.Parameters.AddWithValue(new SqlParameter("Column_Name", columnName));
cn.Open();
readAssess = cmdReadAssess.ExecuteReader();
while(readAssess.Read())
{
// Add the rows
chkAssess = readAssess.GetString(0);
}
return chkAssess;
}
You have got several problems here.
Check whether your readAssess has rows like below.
if(readAssess.HasRows)
If it doesn't have rows then trying
chkAssess = readAssess.GetString(0);
would throw this error, as Arrays are index-based.
So your code should be like below
if(readAssess.HasRows)
{
while(readAssess.Read())
{
chkAssess = readAssess.GetString(0);
}
}
Other problem is you need to close both the reader & the connection afterwards.
readAssess.Close();
cn.Close();
Also your code is potentially vulnerable to SQL Injection.
if (reader.HasRows)
{
while (reader.Read())
{
int result = Convert.ToInt32(reader.GetString(0));
Console.WriteLine(result);
}
}
The most important thing is check the query first by executing in SQL Server and see if any result is coming or not.
Secondly based on the type of output you are receiving cast it to that particular data type (important).Mostly everyone is saving the data in varchar so.
Below is code in which I have written only save first row value in database but when I try to save multiple row value it gives an error. I don't know how to use loop in this code and where to use loop to insert multiple rows in database at once.
How do I save DataGridView values into a SQL Server database?
private void button1_Click(object sender, EventArgs e)
{
SqlCommand cmd = new SqlCommand("INSERT INTO datagrid (sr, name, email, tel_no) VALUES(#c1,#c2,#c3,#c4)", cs);
{
cmd.Parameters.Add(new SqlParameter("#C1", SqlDbType.VarChar));
cmd.Parameters.Add(new SqlParameter("#C2", SqlDbType.VarChar));
cmd.Parameters.Add(new SqlParameter("#C3", SqlDbType.VarChar));
cmd.Parameters.Add(new SqlParameter("#C4", SqlDbType.VarChar));
cs.Open();
foreach (DataGridViewRow row in dataGridView1.Rows)
{
{
if (!row.IsNewRow)
{
cmd.Parameters["#C1"].Value = row.Cells[0].Value;
cmd.Parameters["#C2"].Value = row.Cells[1].Value;
cmd.Parameters["#C3"].Value = row.Cells[2].Value;
cmd.Parameters["#C4"].Value = row.Cells[3].Value;
cmd.ExecuteNonQuery();
}
cs.Close();
}
}
}
}
There's some information that would be nice to have that you didn't put in your original question:
cs is most likely a SqlConnection, and since you say it works inserting one row I'm guessing it's a global (class level) variable and is created somewhere else. I would do a little bit differently (see my code example for the reason why).
What error are you getting? Based on the problem description, I'll bet it is a closed connection (because you're closing it at the end of your foreach code block, when you should be closing it outside the foreach code block).
So, with that said, here's something that might do the trick for you:
private void button1_Click(object sender, EventArgs e)
{
using (SqlConnection conn = new SqlConnection(connectionString))
{
cs.Open();
foreach (DataGridViewRow row in dataGridView1.Rows)
{
if (!row.IsNewRow)
{
using (SqlCommand cmd = new SqlCommand("INSERT INTO datagrid (sr, name, email, tel_no) VALUES(#c1,#c2,#c3,#c4)", conn))
{
cmd.Parameters.AddWithValue("#C1", row.Cells[0].Value);
cmd.Parameters.AddWithValue("#C2", row.Cells[1].Value);
cmd.Parameters.AddWithValue("#C3", row.Cells[2].Value);
cmd.Parameters.AddWithValue("#C4", row.Cells[3].Value);
cmd.ExecuteNonQuery();
}
}
}
}
}
In the example above, I use using blocks for the SqlConnection and SqlCommand objects. The using block ensures that the resources are properly cleaned up when the using block is exited - this way you don't have to worry about things like when to call conn.Close(), as the using block will take care of that for you.
Also, I create the SqlConnection in the method. The connectionString in this case would be a string variable (at the class level, so all methods that need it can access it) holding the connection string.
Finally, I create the SqlCommand in the if block, which will only be entered if the !row.IsNewRow expression evaluates to true. I'm not 100% sure you can reassign values to a an existing command's parameters (most likely you can, but...)
I would also suggest including some error handling in case something goes wrong with the insert.
Hopefully this addresses the questions/issues you have. If not, please provide more detail so we can better assist you. Happy coding!
The problem is that cs is closed more times than it is opened.
You open the connection, insert, but then try to close for each iteration.
Either you should open a connection for each iteration, or you should see how to do everything with only only connection.
int ab;
int PIrowss = dataGridView2.Rows.Count;
for (ab = 0; ab < PIrowss; ab++)
{
PiCGetAutID();
purchaeOrder.pcautoid = Catget;
purchaeOrder.ponum = label119.Text;
purchaeOrder.col1 = dataGridView2.Rows[ab].Cells[0].Value.ToString();
purchaeOrder.col2 = dataGridView2.Rows[ab].Cells[1].Value.ToString();
purchaeOrder.col3 = dataGridView2.Rows[ab].Cells[2].Value.ToString();
purchaeOrder.col4 = dataGridView2.Rows[ab].Cells[3].Value.ToString();
purchaeOrder.col5 = dataGridView2.Rows[ab].Cells[4].Value.ToString();
purchaeOrder.POcSave();
}
private void button1_Click(object sender, EventArgs e)
{
SqlConnection conn = new SqlConnection();
conn.Open();
SqlCommand comm = new SqlCommand();
comm.Connection = conn;
string sr = null;
string name = null;
string email = null;
string tel_no = null;
for (int i = 0; i <= this.DataGridView1.Rows.Count; i++) {
sr == this.DataGridView1.Rows(i).Cells(0).Value.ToString()
name == this.DataGridView1.Rows(i).Cells(1).Value.ToString()
email == this.DataGridView1.Rows(i).Cells(2).Value.ToString()
tel_no == this.DataGridView1.Rows(i).Cells(3).Value.ToString()
comm.CommandText = "insert into mytable(name,age) values('" & name & "','" & age& "')"
comm.ExecuteNonQuery()
conn.Close()
}
}
Try this and see. It should work
Please take a look at the following code.
protected void Button2_Click(object sender, EventArgs e)
{
SqlConnection con = new SqlConnection(constring);
SqlCommand cmd = new SqlCommand();
if (DropDownList3.SelectedItem.Text == "Economy")
{
seats = Convert.ToInt32(DropDownList1.SelectedItem.Text);
cmd.Connection = con;
con.Open();
cmd.CommandText = "select easeats from flight where fno='" + fn + "'";
int eds = Convert.ToInt32(cmd.ExecuteScalar());
if (eds > seats)
{
Panel2.Visible = true; //seats available
cl = DropDownList3.SelectedItem.Text;
seat = seats.ToString();
seats = eds;
}
else
{
Panel3.Visible = true; // seats not available
}
con.Close();
}
}
I am getting error in the line:int eds = Convert.ToInt32(cmd.ExecuteScalar());
And the error is
error in converting varchar value to datatype int
What is wrong with this code?
Firstly, NEVER construct your query like this. Use parameterized queries instead.
Secondly, the error message is quite clear - you're trying to convert to int some varchar column, that probably contains some literal characters as well and not only numbers...
Thirdly, prefer "using" statements over explicitly closing the connection. It's more safe that way.
try to replace:
int eds = Convert.ToInt32(cmd.ExecuteScalar());
with:
int eds = 0;
int.TryParse(cmd.ExecuteScalar(), out eds);
in this way if the Convert fails you have no issues and continue with eds = 0...
side note, your handling of exceptions and connection lifetime is very poor, think about replacing the whole block in this way:
protected void Button2_Click(object sender, EventArgs e)
{
using(var con = new SqlConnection(constring))
using(var cmd = con.CreateCommand())
{
if (DropDownList3.SelectedItem.Text == "Economy")
{
seats = Convert.ToInt32(DropDownList1.SelectedItem.Text);
con.Open();
cmd.CommandText = "select easeats from flight where fno='" + fn + "'";
int eds = 0;
object result = cmd.ExecuteScalar();
int.TryParse(result, out eds);
if (eds > seats)
{
Panel2.Visible = true; //seats available
cl = DropDownList3.SelectedItem.Text;
seat = seats.ToString();
seats = eds;
}
else
{
Panel3.Visible = true; // seats not available
}
}
}
}
of course, anyway, you should also consider to refactor the whole thing and separate clearly database and business logic from UI logic, in general you should never deal directly with connections and queries inside the UI and even less in a ButtonClick event handler.
I am developing a WinForm Application in C Sharp on the .net framework.
The database string I am using as of now is
<add key="Conn" value="Data Source=MNTCON016; Database=Overtime_Calculator;Trusted_Connection=True;MultipleActiveResultSets=true" />
As I am using Microsoft SQL Server 2005 for development, I can use 2 data readers simultaneously using the MultipleActiveResultSets property to true as mentioned above.
The Method used to invoke the 2 data readers is as follows:
public static void SignUpControllerDay(DateTime Date, System.Windows.Forms.DataGridView PassedGrid)
{
string sql_SignUp = String.Format(#"SELECT Emp_ID as Emp_ID, Name as Name, Sum(Sum) as Sum FROM
(SELECT DISTINCT o.Date, e.Emp_ID as Emp_ID,
e.First_Name+ ' ' +e.Last_Name as Name,
o.Quantity as Sum
FROM Employee e,OT_Hours o,Position p,Signup_Sheet s
WHERE e.Emp_ID=o.Emp_ID
and e.Emp_ID = s.Employee_ID
and s.Day_Shift = 1
and e.Position_ID = p.Position_ID
and p.Position_Name = 'Controller'
and o.Quantity NOT IN(0.3)
and s.Date = '{0}'
and o.Date <= CONVERT(VARCHAR,'{0}',101) AND o.Date > CONVERT(VARCHAR,DATEADD(YYYY,-1,'{0}'),101) )
as OVERTIME
GROUP BY Emp_ID,Name
ORDER BY Sum", Date);
SqlConnection sqlConn = null;
SqlCommand cmd_SignUp;
SqlDataReader dr_SignUp;
try
{
sqlConn = new SqlConnection(databaseConnectionString);
sqlConn.Open();
cmd_SignUp = new SqlCommand(sql_SignUp, sqlConn);
dr_SignUp = cmd_SignUp.ExecuteReader();
while (dr_SignUp.Read())
{
ArrayList arrPhone = new ArrayList();
string sql_Phone = String.Format("SELECT Phone_Number FROM Contact_Details WHERE Emp_ID = {0}", dr_SignUp["Emp_ID"]);
SqlCommand cmd_Phone = new SqlCommand(sql_Phone, sqlConn);
SqlDataReader dr_Phone = cmd_Phone.ExecuteReader();
while (dr_Phone.Read())
{
arrPhone.Add(dr_Phone["Phone_Number"].ToString());
}
//--Retrieving Sectors
ArrayList arrSector = new ArrayList();
string sql_Sector = String.Format(#"SELECT e1.EMP_ID,
( SELECT cast(Sector_ID as varchar(10)) + ';'
FROM Employee_Sector_relationship e2
WHERE e2.Emp_ID = e1.Emp_ID
ORDER BY Sector_ID
FOR XML PATH('') ) AS Sectors
FROM Employee_Sector_Relationship e1
WHERE Emp_ID = {0}
GROUP BY Emp_ID ", dr_SignUp["Emp_ID"]);
SqlCommand cmd_Sector = new SqlCommand(sql_Sector, sqlConn);
SqlDataReader dr_Sector = cmd_Sector.ExecuteReader();
while (dr_Sector.Read())
{
arrSector.Add(dr_Sector["Sectors"].ToString());
}
if (arrSector.Count == 0)
{ arrSector.Add(" "); }
if (arrPhone.Count == 0)
{ arrPhone.Add(" "); }
//--
if (arrPhone.Count == 2)
{
PassedGrid.Rows.Add(dr_SignUp["Emp_ID"].ToString(), dr_SignUp["Name"].ToString(), arrSector[0], dr_SignUp["Sum"], arrPhone[0], arrPhone[1]);
}
else
{
PassedGrid.Rows.Add(dr_SignUp["Emp_ID"].ToString(), dr_SignUp["Name"].ToString(), arrSector[0], dr_SignUp["Sum"], arrPhone[0]);
}
}
}
catch (Exception e)
{
MessageBox.Show("Error found in SignUpControllerDay..." + Environment.NewLine + e.ToString());
}
finally
{
if (sqlConn != null)
{
sqlConn.Close();
}
}
}
Everything works fine.
Now the real problem. I have been informed that the production SQL server for the application to go live is Microsoft SQL server 2000. After doing a bit research, I came to know that Microsoft server 2000 does not support multiple active results sets propery. In short, it does not allow me to use 2 data readers simultaneously.
I need to know how to read the data from 2 different tables, simultaneously, with regards to SQL Server 2000.
Are there any other ways that i can read data as I have mentioned in the code..
Please help..
the application is almost done and is ready to go to production. but MS server 2000 doesnt allow the applcaition to work accordingly...
please help
You can have two active datareaders in Sql Server 2000 by simply creating two connections.
To demonstrate this, I must first berate you for using two very poor practices: dynamic sql and arraylists. Neither have any place in your code. You should also read up on the using construct, though you have my apologies and condolences on "using" and "arraylists" if you're still using .net 1.1.
That said, here's how the code should look:
string sql_Phone = "SELECT Phone_Number FROM Contact_Details WHERE Emp_ID = #EmpID";
using (SqlConnection cn2 = new Sqlconnection(databaseConnectionString))
using (SqlCommand cmd_Phone = new SqlCommand(sql_Phone, cn2))
{
cmd_Phone.Parameters.Add("#EmpID", SqlDbType.Int);
cn2.Open();
while (dr_SignUp.Read())
{
List<string> arrPhone = new List<string>();
cmd_Phone.Parameters[0].Value = dr_SignUp["Emp_ID"];
using (SqlDataReader dr_Phone = cmd_Phone.ExecuteReader())
{
while (dr_Phone.Read())
{
arrPhone.Add(dr_Phone["Phone_Number"].ToString());
}
}
Also, looking at your code I suspect what you really need to do is re-write your sql. You can combine all those into a single query that you just bind directly to the grid.
Sure:
public void SignUpControllerDay()
{
using (var conn = new SqlConnection(ConnectionString))
using (var cmd = conn.CreateCommand())
{
conn.Open();
cmd.CommandText = "SELECT ...";
using (var reader = cmd.ExecuteReader())
{
while (reader.Read())
{
var phone = reader["Phone_Number"].ToString();
Bar(phone);
}
}
}
}
public void Bar(string phone)
{
using (var conn = new SqlConnection(ConnectionString))
using (var cmd = conn.CreateCommand())
{
conn.Open();
cmd.CommandText = "SELECT ..."; // use phone to prepare statement
using (var reader = cmd.ExecuteReader())
{
while (reader.Read())
{
// Fill the grid
}
}
}
}
You could open multiple database connections with 1 reader per connection
You could also add MultipleActiveResultSets=True; to the connection string, even though it's not recommended.
so, it is not possible! as simple as that the only answer!
multiple connection is a workaroud!
one connection can not handle multiple recordsets simultaneously