Search function in VB.NET

Question

This is my line of code to search the information from the database. I am trying to display the result obtained from the execution of this line. Should I just use a message box or use any object to display it? I do not want to use dataset.

 ACommanad.CommandText = "SELECT * FROM Students where StudentID =" & DeleteRecordTextBox.Text & ""

I am instructed to do it this way without using the parameter — duke, Nov 26 '14 at 18:27
This all depends on the requirements of your client and like Styxxy said, use parameterized queries. — the_lotus, Nov 26 '14 at 18:27
No one would instruct you to do this without parameters, as it's a dangerous SQL injection risk. — rory.ap, Nov 26 '14 at 18:29
http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work — Ňɏssa Pøngjǣrdenlarp, Nov 26 '14 at 19:36
I would say "it depends", how are you going to use it etc... — Trevor, Nov 27 '14 at 04:02

score 1 · Accepted Answer · answered Nov 26 '14 at 18:32

1

Yes. A message box is perfectly acceptable way to display something to the user.

answered Nov 26 '14 at 18:32

Rose

641
7
17

Search function in VB.NET

1 Answers1