System.Data.SqlClient.SqlException was unhandled by user code

Question

SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["RegistrationConnectionString"].ConnectionString);
conn.Open();
string checkUser = " select count(*) form Userdata where Username='" + TextBoxUN.Text + "' ";
SqlCommand cmd = new SqlCommand(checkUser,conn);

if (temp==1)
{
    Response.Write("User Already Exists");
}
conn.Close();

System.Data.SqlClient.SqlException was unhandled by user code HResult=-2146232060 Message=Incorrect syntax near 'Userdata'

int temp= Convert.ToInt32(cmd.ExecuteScalar().ToString());

Well, did you read the sql? What words are "near 'Userdata'"? Do you see anything wrong there? — Lasse V. Karlsen, Apr 23 '14 at 09:36
This question appears to be off-topic because it is just a case of not reading the error message and checking what it refers to. — Lasse V. Karlsen, Apr 23 '14 at 09:39
You should use SQL parameters to prevent SQL Injection : http://stackoverflow.com/questions/7505808/using-parameters-in-sql-statements — Rik, Apr 23 '14 at 09:40
sorry for that i had made correction next time i will take care — user3555689, Apr 23 '14 at 09:41

Guffa · Accepted Answer · 2014-04-23T10:59:49.327

The error message says:

Incorrect syntax near 'Userdata'

That tells you that the SQL parser gave up at the word Userdata because the syntax no longer made sense, which usually means that the actual error is close before that word.

If you look at that part of your query:

select count(*) form Userdata

The word right before Userdata is form, but you should recognise that it's not the keyword from that you intended to write.

Side note (but an important one): The value that you concatentate into the query is not properly escaped, so the code is wide open to SQL injection attacks. You should use a parameter to put the value in the query:

string checkUser = "select count(*) from Userdata where Username = @Username";
SqlCommand cmd = new SqlCommand(checkUser,conn);
cmd.Parameters.AddWithValue("@Username", TextBoxUN.Text);

System.Data.SqlClient.SqlException was unhandled by user code

1 Answers1