I got and SQL select syntax error

Question

I want to find the number of rows in the table data urunAd but I get an error like this

Syntax error (missing operator) in query expression 'urunAd='.

OleDbCommand komut = new OleDbCommand(
    "SELECT COUNT(*) FROM Urunler WHERE urunAd= " + tbAd.Text + "", baglan);

and also - How do I present the results in my ASP.Net?

Always use parameterized queries, as it is your query is vulnerable for sql-injection https://en.wikipedia.org/wiki/SQL_injection — Esko, Jul 15 '16 at 07:01

score 2 · Accepted Answer · edited May 23 '17 at 10:28

you are assigning text. You should add '' around the text:

OleDbCommand komut = new OleDbCommand(
    "SELECT COUNT(*) FROM Urunler WHERE urunAd='" + tbAd.Text + "'", baglan);

but instead of doing so - use parameterized queries: (here is a short example)

using (OleDbCommand komut = new OleDbCommand("SELECT COUNT(*) FROM Urunler WHERE urunAd=@value", connection))
{
    komut.CommandType = CommandType.Text;
    komut.Parameters.AddWithValue("@value", tbAd.Text);
    /* execute the query... */
}

For presenting the results in your ASP.Net a quick search on google along the line of "how to present result from sql command in asp.net" gave quite a few results. Among them

I got and SQL select syntax error

1 Answers1