What is the missing operator in this sql query?

Question

This is from a VB.Net program:

Dim cmd As String = "SELECT * FROM Employees WHERE Employee Name LIKE '%" & TextBox1.Text & "%';"

When it executes, it says that there is a syntax error (missing operator) in query expression 'Employee Name LIKE '%some text here%'

What am I missing here?

Please don't concat SQL statements like this, use SQL parameters. — Lloyd, Feb 25 '14 at 12:46
Granted this code may be subject to SQL injection but a lot depends on context. The cost of heightened security may not be worth the expense if there is zero exposure. — rheitzman, Feb 25 '14 at 15:52

score 3 · Accepted Answer · edited May 23 '17 at 11:57

3

If Employee Name is the name of your column then you have to put square brackets around it to avoid confusing the parser.

Dim cmd As String = "SELECT * FROM Employees WHERE " & _ 
                    "[Employee Name] LIKE '%" & TextBox1.Text & "%';"

And remember that string concatenation to build sql query is a real danger.
A parameterized query is always the way to go.

Supposing that you are working with Sql Server

Dim cmd As String = "SELECT * FROM Employees WHERE " & _ 
                    "[Employee Name] LIKE @name"
Using con = new SqlConnection(.....)
Using cmd = new SqlCommand(cmd, con)
   con.Open()
   cmd.Parameters.AddWithValue("@name", "%" & TextBox1.Text & "%")
   Using reader = cmd.ExecuteReader()
        .....
   End Using
End Using
End Using

edited May 23 '17 at 11:57

Community

1
1

answered Feb 25 '14 at 12:45

Steve

213,761
22
232
286

it should be a comment not an answer yar – Neel Feb 25 '14 at 12:46
1

A comment? Why, this is the error and this is the answer – Steve Feb 25 '14 at 12:47
you have updated your answer when I wrote the comment it was not clear it was looking like a comment – Neel Feb 25 '14 at 12:48
Why exactly is it bad to concat sql strings? It gets the job done for me. – Nerdsworth Feb 25 '14 at 12:55
2

until someone enters `'; DELETE Employees; --` – devio Feb 25 '14 at 13:07
Look carefully at the link posted above (real danger) and, if you are not convinced then try to write an employee name containing a single quote (O'Brian for example) – Steve Feb 25 '14 at 13:10

What is the missing operator in this sql query?

1 Answers1