C# SQL result as variable

Question

On my main form I have queried the user id on submission. Once I save the id to a variable how can I call it on another windows form in the same application?

This is what I have so far

    private void btnLogin_Click(object sender, EventArgs e)
    {
        SqlConnection con = new SqlConnection("Data Source=.database.windows.net;Initial Catalog=userlogins;Persist Security Info=True;User ID=****;Password=****");
        SqlDataAdapter sda = new SqlDataAdapter("Select ID from users where username='" + txtUsername.Text + "' and password='" + txtPassword.Text + "' ", con);
        SqlCommand cmd = con.CreateCommand();
        con.Open();

        // save SQL ID to variable
        cmd.CommandText = "Select Id from users where username = '" + txtUsername.Text + "'";
        int sqlid = ((int)cmd.ExecuteScalar());

Any information would be appreciated, I really need the ID on multiple other pages!

Possible duplicate of [Communicate between two windows forms in C#](http://stackoverflow.com/questions/1665533/communicate-between-two-windows-forms-in-c-sharp) — René Vogt, Apr 05 '16 at 15:21
[SQL Injection alert](http://msdn.microsoft.com/en-us/library/ms161953%28v=sql.105%29.aspx) - you should **not** concatenate together your SQL statements - use **parametrized queries** instead to avoid SQL injection — marc_s, Apr 05 '16 at 15:45

score 0 · Answer 1 · answered Apr 05 '16 at 15:22

If you are using the ExecuteScalar() method, it's important to remember that this will only return the contents of the first cell in your results, so it can generally help to use in conjunction with a TOP 1 statement.

Additionally, you should consider refactoring your code to use parameterization, which should help avoid nastiness like SQL Injection and will also help mitigate any syntax issues :

// Build your connection
using(var con = new SqlConnection("your-connection-string"))
{
     // Build your query
     var query = "SELECT TOP 1 ID FROM users WHERE username = @username AND password = @password";
     // Build a command to execute your query
     using(var cmd = new SqlCommand(con,query))
     {
          // Open your connection
          con.Open();
          // Add your parameters
          cmd.Parameters.AddWithValue("@username", txtUsername.Text);
          cmd.Parameters.AddWithValue("@password", txtPassword.Text);

          // Get your ID
          var sqlid = Convert.ToInt32(cmd.ExecuteScalar());
          // Do something here
     }
}

score 0 · Answer 2 · answered Apr 05 '16 at 15:33

One way to do this is with events:

public class IdChangedEventArgs : EventArgs
{
  int ChangedId {get;set;};
}

public delegate void IdChangedEventHandler(object sender, IdChangedEventArgs e);
public event IdChangedEventHandler IdChangedEvent;
private void btnLogin_Click(object sender, EventArgs e)
{
  int sqlid = ((int)cmd.ExecuteScalar());
  IdChangedEvent(this, new IdChangedEventArgs {ChangedId = sqlid;} );
}

In each of your interested forms, subscribe to the events. When handled, update your GUI however you want.

C# SQL result as variable

2 Answers2