We Keep Coding

'The variable name '#' has already been declared. Variable names must be unique within a query batch or stored procedure.'

string subject= "INSERT INTO Subjects (ThesisNo, [Subject]) VALUES (2, #subject)";
SqlCommand commandSubject = new SqlCommand(subject,con);
string temp;
foreach (var control in checkedListBox.CheckedItems)
{
temp = control.ToString();
commandSubject.Parameters.AddWithValue("#subject", temp);
}
con.Open();
commandSubject.ExecuteNonQuery();
con.Close();
I want to add items that are checked in the Checkedlistbox to #subject.
But I can only add one item. How can I add all checked items to #subject?

You're adding parameters inside the loop. Add outside, and set the value inside and execute every time:
using(SqlConnection con = ...) {
string subject= "INSERT INTO Subjects(ThesisNo,[Subject]) VALUES (2, #subject)";
con.Open();
SqlCommand commandSubject = new SqlCommand(subject,con);
commandSubject.Parameters.Add("#subject", SqlDbType.VarChar);
foreach (var control in checkedListBox.CheckedItems)
{
commandSubject.Parameters["#subject"].Value = control.ToString();
commandSubject.ExecuteNonQuery();
}
}
Or if you're wanting to execute once you need to modify the SQL, and add as you go, so that you end up with an SQL like e.g. INSERT INTO .. VALUES (2,#p0), (2,#p1), (2,#p2) and a parameters collection that is 3 long (#p0 to #p2) with 3 different data values:
using(SqlConnection con = ...) {
string subject= "INSERT INTO Subjects(ThesisNo,[Subject])VALUES";
SqlCommand commandSubject = new SqlCommand(subject, con);
int p=0;
foreach (var control in checkedListBox.CheckedItems)
{
commandSubject.CommandText += $"(2,#subject{p}),"
commandSubject.Parameters.Add($"#subject{p}", SqlDbType.VarChar).Value = control.ToString();
p++;
}
commandSubject.CommandText = commandSubject.CommandText.TrimEnd(','); //remove trailing comma from concat
con.Open();
commandSubject.ExecuteNonQuery();
}
If you have thousands of these string concats to do, use a StringBuilder. For what you might reasonably want a user to tick in a UI (20 or fewer?) string concat will be fine

The best method depends on whether the number of items is large and variable.
If that is the case either a Table-Valued Parameter or using SqlBulkCopy is the most performant option.
Here is how you would do SqlBulkCopy:
var table = new DataTable{
Columns = {
{"ThesisNo", typeof(int)},
{ "Subject", typeof(string)
}
};
foreach (var control in checkedListBox.CheckedItems)
DataTable.Rows.Add(2, control.ToString());
using(var bulk = new SqlBulkCopy(con, SqlBulkCopyOptions.CheckConstraints | SqlBulkCopyOptions.FireTriggers)
{
DestinationTableName = "Subjects"
})
bulk.WriteToServer(table);
The other method, which, at a push, you can get away with on smaller sets, is to add a numbered parameter for each item. The maximum is 2100. Do NOT do this if range of possible rowcounts is large, otherwise you will kill your query plan store:
using(SqlCommand comm = new SqlCommand("",con))
{
var n = 0;
foreach (var control in checkedListBox.CheckedItems)
comm.Parameters.Add("#subject" + (++n), SqlDbType.Varchar, *sizeofcolumnhere*).Value = control.ToString();
comm.CommandText = "INSERT INTO Subjects(ThesisNo,[Subject])\r\nVALUES\r\n" +
string.Join("\r\n",
Enumerable.Range(1, n).Select(i => $"(2 ,#subject{i})");
comm.ExecuteNonQuery();
}

Add the line 'SqlCommand commandSubject = new SqlCommand(subject,con)' to the foreach loop:
string subject= "INSERT INTO Subjects (ThesisNo, [Subject]) VALUES
(2, #subject)";
string temp;
foreach (var control in checkedListBox.CheckedItems)
{
SqlCommand commandSubject = new SqlCommand(subject,con);
temp = control.ToString();
commandSubject.Parameters.AddWithValue("#subject", temp);
}
con.Open();
commandSubject.ExecuteNonQuery();
con.Close();

Query working in mysql but not from c# code

I am having c# code like this:
using (MySqlConnection con = new MySqlConnection(AR.ConnectionString))
{
con.Open();
using (MySqlCommand cmd = new MySqlCommand(#"SELECT PORUDZBINAID, USERID, BRDOKKOM, DATUM,
STATUS, MAGACINID, PPID, INTERNIKOMENTAR, REFERENT_OBRADE, NACIN_PLACANJA, TAG FROM
PORUDZBINA WHERE TAG LIKE '%#MOB%'", con))
{
cmd.Parameters.AddWithValue("#MOB", Mobilni);
MySqlDataReader dr = cmd.ExecuteReader();
while (dr.Read())
list.Add(new Porudzbina()
{
PorudzbinaID = Convert.ToInt32(dr[0]),
UserID = Convert.ToInt32(dr[1]),
BrDokKom = Convert.ToInt32(dr[2]),
Datum = Convert.ToDateTime(dr[3]),
Status = (PorudzbinaStatus)Convert.ToInt32(dr[4]),
MagacinID = Convert.ToInt32(dr[5]),
PPID = (dr[6] is DBNull) ? (int?)null : Convert.ToInt32(dr[6]),
InterniKomentar = (dr[7] is DBNull) ? null : dr[7].ToString(),
ReferentObrade = (dr[8] is DBNull) ? (int?)null : Convert.ToInt32(dr[8]),
NacinUplate = (PorudzbinaNacinUplate)Convert.ToInt32(dr[9]),
Tag = JsonConvert.DeserializeObject<Properties>(dr["TAG"].ToString())
});
}
}
I put breakpoint and it passes good paramter to query but doesn't enter while() loop (so i is not reading) and it returns no rows.
When i enter same query in my mysql and replace #MOB with parameter passed there, it does return me one row.
I guess problem is something with passing LIKE through c# but not sure why it does that.

You need to change how you are adding parameters slightly:
In your SQL, no quotes and no % symbols.
using (MySqlCommand cmd = new MySqlCommand(#"SELECT PORUDZBINAID, USERID, BRDOKKOM, DATUM,
STATUS, MAGACINID, PPID, INTERNIKOMENTAR, REFERENT_OBRADE, NACIN_PLACANJA, TAG FROM
PORUDZBINA WHERE TAG LIKE #MOB", con))
{
Then the parameter like this, without quotes.
cmd.Parameters.AddWithValue("#MOB", "%" + Mobilni + "%");
BTW: Ideally you should not use AddWithValue, but rather Add(). See this blog:
https://blogs.msmvps.com/jcoehoorn/blog/2014/05/12/can-we-stop-using-addwithvalue-already/
And this SO post:
MySqlCommand Command.Parameters.Add is obsolete
Instead, it should be like this:
cmd.Parameters.Add("#MOB", SqlDbType.Varchar).Value = "%" + Mobilni + "%";
//you must update to use the correct DBType for your data

Since #MOB is inside single quotes, it's interpreted as a string literal, which isn't what you meant. You can fix this by concatenating the placeholder to the % characters:
using (MySqlCommand cmd = new MySqlCommand(
#"SELECT PORUDZBINAID, USERID, BRDOKKOM, DATUM, STATUS, MAGACINID, PPID, INTERNIKOMENTAR, REFERENT_OBRADE, NACIN_PLACANJA, TAG
FROM PORUDZBINA
WHERE TAG LIKE CONCAT('%', #MOB, '%')", con))

C# MySQL adding multiple of the same parameter with a loop

Update: as the original question was essentially answered, I've marked this as complete.
I have a C# project in which I'd like to query a database. The SQL query will SELECT from a table, and in the WHERE clause I want to filter the results from a pre-defined list of values specified in C#.
List<string> productNames = new List<string >() { "A", "B", "C" };
foreach (name in productNames)
{
string query = #"
SELECT *
FROM products
WHERE name IN (#name);";
// Execute query
MySqlCommand cmd = new MySqlCommand(query, dbConn);
cmd.Parameters.AddWithValue("name", name);
MySqlDataReader row = cmd.ExecuteReader();
while (row.Read())
{
// Process result
// ...
}
}
However I'm getting an error:
There is already an open DataReader associated with this Connection
which must be closed first
Is it not possible then to use a for loop to add parameters this way to a SELECT statement?

You need to dispose your object to not get the exception. However you don't need to iterate over values and run a query for every value in the list. Try the following code. It makes a parameter for every value and adds it to command to use in "IN (...)" clause.
Also "using" keywords handles disposing objects.
List<string> productsIds = new List<string>() { "23", "46", "76", "88" };
string query = #"
SELECT *
FROM products
WHERE id IN ({0});";
// Execute query
using (MySqlCommand cmd = new MySqlCommand(query, dbConn))
{
int index = 0;
string sqlWhere = string.Empty;
foreach (string id in productsIds)
{
string parameterName = "#productId" + index++;
sqlWhere += string.IsNullOrWhiteSpace(sqlWhere) ? parameterName : ", " + parameterName;
cmd.Parameters.AddWithValue(parameterName, id);
}
query = string.Format(query, sqlWhere);
cmd.CommandText = query;
using (MySqlDataReader row = cmd.ExecuteReader())
{
while (row.Read())
{
// Process result
// ...
}
}
}

You are doing few things wrong. Let me point out them:
Everything is fine in the first iteration of the loop, when you are in second iteration the First Reader associated with the command remains opened and that result in current error.
You are using Where IN(..) you you can specify the values within IN as comma separated so there is no need to iterate through parameters.
You can use String.Join method to construct this values with a comma separator.
Now take a look into the following code:
List<int> productsIds = new List<int>() { 23, 46, 76, 88 };
string idInParameter = String.Join(",", productsIds);
// Create id as comma separated string
string query = "SELECT * FROM products WHERE id IN (#productId);";
MySqlCommand cmd = new MySqlCommand(query, dbConn);
cmd.Parameters.AddWithValue("#productId", idInParameter);
MySqlDataReader row = cmd.ExecuteReader();
while (row.Read())
{
// Process result
// ...
}
Please note if the id field in the table is not integers then you have to modify the construction of idInParameter as like the following:
idInParameter = String.Join(",", productsIds.Select(x => "'" + x.ToString() + "'").ToArray());

Pass the comma separated productIds string instead of looping. Read more about IN here.
string productIdsCommaSeparated = string.Join(",", productsIds.Select(n => n.ToString()).ToArray())
string query = #"
SELECT *
FROM products
WHERE id IN (#productId);";
// Execute query
MySqlCommand cmd = new MySqlCommand(query, dbConn);
cmd.Parameters.AddWithValue("productId", productIdsCommaSeparated );
MySqlDataReader row = cmd.ExecuteReader();
while (row.Read())
{
// Process result
// ...
}
The error you are getting is because you do not close the MySqlDataReader. You must close it to get rid of error before you call ExecuteReader in next iteration but this is not proper way in this case.

From what I tried and tested seems best solution (especially for text column types) is to create a list of individual parameters and add it as a range the to the query and parameters.
e.g:
List<MySqlParameter> listParams = new List<MySqlParameter>();
for (int i = 0; i < listOfValues.Length; i++)
{
listParams.Add(new MySqlParameter(string.Format("#values{0}", i),
MySqlDbType.VarChar) { Value = listOfValues[i] });
}
string sqlCommand = string.Format("SELECT data FROM table WHERE column IN ({0})",
string.Join(",", listParams.Select(x => x.ParameterName)));
......
using (MySqlCommand command = new MySqlCommand(sqlCommand, connection)
{
............
command.Parameters.AddRange(listParams.ToArray());
............
}

SQL query return List

I can't seem to get this working:
My table column headers are 'genre' 'artist' 'album'
and the params I'm passing in are (type, filter, value) ("artist", "genre", "Rock") where there are two rows in the db with "Rock" for the genre.
When I follow the debugger, the 'while (reader.Read())' must return false because the loop is never entered and thus nothing written to the List.
public static List<String> getWithFilter(String type, String filter, String value)
{
List<String> columnData = new List<String>();
string query = "SELECT #type FROM Music WHERE" +
" #filter = '#value'";
SqlConnection connection = Database.GetConnection();
SqlCommand getData = new SqlCommand(query, connection);
getData.Parameters.AddWithValue("#type", type);
getData.Parameters.AddWithValue("#filter", filter);
getData.Parameters.AddWithValue("#value", value);
connection.Open();
using (connection)
{
using (getData)
{
using (SqlDataReader reader = getData.ExecuteReader())
{
while (reader.Read())
{
columnData.Add(reader.GetString(0));
}
}
}
}
return columnData;
}

You cannot use parameters for the names of columns and you don't put quotes around them when using them. Right now your query is the equivalent of
SELECT 'artist' FROM Music WHERE 'genre' = '#value'
You can do the following instead.
string query = "SELECT " + type + " FROM Music WHERE " + filter + " = #value";
And just remove the lines that create the #type and #fitler parameters.

You're looking either for formatting or string interpolation (requires C# 6.0):
string query =
$#"SELECT {type}
FROM Music
WHERE {filter} = #value";
...
getData.Parameters.AddWithValue("#value", value);
Formatting is a bit more wordy:
string query = String.Format(
#"SELECT {0}
FROM Music
WHERE {1} = #value", type, filter);

I assuming that you're using .net 2
DateTime current = DateTime.Now;
Console.WriteLine(current);
SqlConnection conn = new SqlConnection();
string q = "SELECT #field FROM student";
SqlDataAdapter da = new SqlDataAdapter(q, conn);
da.SelectCommand.Parameters.AddWithValue("#field", "snName");
DataTable dt = new System.Data.DataTable();
conn.Open();
da.Fill(dt);
conn.Close();
List<string> names = new List<string>();
foreach (DataRow dr in dt.Rows)
{
names.Add(dr[0].ToString());
}
Console.WriteLine("Fetching {0} data for {1}", names.Count, DateTime.Now - current);
Console.ReadKey();
You can use lambda expression to mapping the datatable in .net >4

SQL command not properly ended error while filtering gridview on checkboxlist select

I am trying to filter my gridview on the basis of checkboxlist selected.
So here is what I tried
string constr = ConfigurationManager.ConnectionStrings["OracleConn"].ConnectionString;
string strQuery = "select sr_no, type, stage, ref_no, ref_date, party_name, amount, remarks, exp_type, " +
"voucher_no, cheque_no,cheque_dt, chq_favr_name from XXCUS.XXACL_PN_EXPENSE_INFO";
string condition = string.Empty;
foreach (ListItem li in ddlStatus.Items)
{
condition += li.Selected ? string.Format("'{0}',", li.Value) : string.Empty;
if (!string.IsNullOrEmpty(condition))
{
condition += string.Format(" Where type IN ({0})", condition.Substring(0, condition.Length - 1));
}
using (OracleConnection conn = new OracleConnection(constr))
{
using (OracleCommand cmd = new OracleCommand(strQuery + condition))
{
using (OracleDataAdapter sda = new OracleDataAdapter(cmd))
{
cmd.Connection = conn;
using (DataTable dtcheck = new DataTable())
{
sda.Fill(dtcheck);
GridExpInfo.DataSource = dtcheck;
GridExpInfo.DataBind();
}
}
}
}
but I am getting error as
ORA-00933: SQL command not properly ended
My debugged query is
select sr_no, type, stage, ref_no, ref_date, party_name, amount, remarks, exp_type, voucher_no, cheque_no,cheque_dt, chq_favr_name
from XXCUS.XXACL_PN_EXPENSE_INFO'10',
Where type IN ('10')
I took reference from here

You should prepare the where condition using a List of strings and run the query after you have completed the query builder phase.
// Create a list of your conditions to put inside the IN statement
List<string>conditions = new List<string>();
foreach (ListItem li in ddlStatus.Items)
{
if(li.Selected)
conditions.Add($"'{li.Value}'");
}
// Now build the where condition used
string whereCondition = string.Empty;
if (condition.Count > 0)
{
// This produces something like "WHERE type in ('10', '11', '12')"
// The values for the IN are directly concatenated together
whereCondition = " Where type IN (" + string.Join(",", conditions) + ")";
}
using (OracleConnection conn = new OracleConnection(constr))
{
using (OracleCommand cmd = new OracleCommand(strQuery + whereCondition))
{
....
Consider that this approach is very exposed to Sql Injection attacks and to a parsing problems if your selected values are strings containing quotes
Instead if you start using parameters then your code should be changed to
int count = 1;
List<OracleParameter> parameters = new List<OracleParameter>();
List<string>conditions = new List<string>();
foreach (ListItem li in ddlStatus.Items)
{
if(li.Selected)
{
// parameters are named :p1, :p2, :p3 etc...
conditions.Add($":p{count}");
// Prepare a parameter with the same name of its placeholder and
// with the exact datatype expected by the column Type, assign to
// it the value and add the parameter to the list
OracleParameter p = new OracleParameter($":p{count}",OracleType.NVarChar);
p.Value = li.Value;
parameters.Add(p);
count ++;
}
}
if (condition.Count > 0)
{
// This produces something like "WHERE type in (:p1, :p2, :p3)"
// The values are stored before in the parameter list
whereCondition = " Where type IN (" + string.Join(",", conditions) + ")";
}
using (OracleConnection conn = new OracleConnection(constr))
{
using (OracleCommand cmd = new OracleCommand(strQuery + whereCondition))
{
// Add the parameters with the expected names, type and value.
cmd.Parameters.AddRange(parameters.ToArray());
....
It is a little more lines but this prevents Sql Injection and there is no more problem in parsing strings