ASP NET SQL - select * from where author

Question

I'm having a problem showing equal results from SQL database

"select * from Log where Author=" + User.Identity.Name

That's the current command I've tried, but can't get it working.

while this works:

"select * from Log where Author='markus'"

Thanks for any help.

You need quotes around the value User.Identity.Name in the SQL statement. — Sloan Thrasher, Apr 01 '17 at 20:41
"select * from Log where Author='" + User.Identity.Name + "'" — Sloan Thrasher, Apr 01 '17 at 20:41
I dont recommend doing this but try wrapping the string into single quotes: `"select * from Log where Author='" + User.Identity.Name + "'"`. Standard way of doing this is using prepared statements. — Gurwinder Singh, Apr 01 '17 at 20:42
@GurV - what do you mean with prepared statements? I'm new to SQL — Luke Remming, Apr 01 '17 at 20:48
@Luke - Take a look at this: http://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements — Gurwinder Singh, Apr 01 '17 at 20:49
@LukeRemming You've heard of SQL injection, right? You don't want to be that useless coder who let it happen. This is what you are allowing with code like this. NEVER glue strings together to form sql statements unless you're 100% sure about the origin of those strings. You can write secure code very easily with [parameterized queries](http://www.dreamincode.net/forums/topic/268104-the-right-way-to-query-a-database-parameterizing-your-sql-queries/). You'd be a fool not to. Really. — spender, Apr 01 '17 at 22:28

Muhammad Qasim · Answer 1 · 2017-04-01T20:48:59.283

0

Try the following:

"Select * from Log where Author='" + User.Identity.Name + "'"

Actually your query is missing single quotes for name that is a string..

edited Apr 01 '17 at 20:48

answered Apr 01 '17 at 20:43

Muhammad Qasim

Say my username is `';drop table users;`? – spender Apr 01 '17 at 22:22
@spender Actually `'; drop table Log; --` would be worse. – juharr Apr 01 '17 at 23:11

score 0 · Accepted Answer · edited May 23 '17 at 11:54

0

You can wrap the string in single quotes like this:

"select * from Log where Author='" + User.Identity.Name + "'"

However the standard way of doing this is using parameterized statements:

"select * from Log where Author = @Author";

Then apply the value to param @Author using SqlParameter.

For more info, see:

edited May 23 '17 at 11:54

Community

answered Apr 01 '17 at 20:54

Gurwinder Singh

DON'T DO THIS. @GurV : You should preface you answer with "This is how ***not*** to do what you want", or bring the risk of SQL injection to the forefront. People looking for quick answers won't bother following a link when they see how easily your solution "works". – spender Apr 01 '17 at 22:24

score 0 · Answer 3 · answered Apr 02 '17 at 04:02

0

You can also use string.Format method for this kind of situations. Try the following.

string query=string.Format("select * from Log where Author='{0}'",User.Identity.Name)

answered Apr 02 '17 at 04:02

3 Answers3