-2

I have this problem in C#, I have already run this query in SQL Server and works

SQL query

SELECT Mineria.dbo.Usuario.ID_Usuario, Mineria.dbo.Usuario.Sexo, Mineria.dbo.Usuario.Idioma, Mineria.dbo.Usuario.Edad, Mineria2.dbo.ARTISTA.Nombre_artistic
INTO Mineria.dbo.Objeto
FROM Mineria.dbo.Usuario
INNER JOIN Mineria2.dbo.ARTISTA ON Mineria2.dbo.ARTISTA.Id_Artista=Mineria.dbo.Usuario.ID_Usuario
AND Mineria.dbo.Usuario.ID_Usuario BETWEEN 35 AND 70
ORDER BY ID_Usuario ASC

I can't find the problem on the c# code

SqlCommand comando = new SqlCommand(string.Format("
Select '" + maskedTextBox1.Text + "' , '" + maskedTextBox2.Text + "' 
INTO Mineria.dbo.Objeto FROM Mineria.dbo.Usuario INNER JOIN Mineria2.dbo.ARTISTA ON Mineria2.dbo.ARTISTA.Id_Artista=Mineria.dbo.Usuario.ID_Usuario 
AND Mineria.dbo.Usuario.ID_Usuario BETWEEN '" + textBox1.Text + "' AND '" + textBox2.Text + "' ORDER BY ID_Usuario ASC"), cn);
Dale K
  • 25,246
  • 15
  • 42
  • 71
Alan Cruz
  • 1
  • 3
    Debugging is part of programmer's job. Have you tried to output `comando` to check whether it generates the right statement or not? – Eric Apr 26 '19 at 23:04
  • 2
    So is using SQL parameters to avoid injection and formatting errors. – LarsTech Apr 26 '19 at 23:10
  • Break it up into a small select... – Chris Catignani Apr 26 '19 at 23:14
  • 2
    Yes this is an sql injection attack waiting to happen, you will find if you use parameters most of these kind of issues will be naturally solved by reducing complexity – TheGeneral Apr 26 '19 at 23:48
  • Please post sample data, i.e. a sample of your raw table data, the results of the first query and the results of the second query. – Dale K Apr 27 '19 at 07:09
  • 2
    Hi Alan! Please don't use string concatenation in you SQL scripts because of SQL Injection. You need to use parameters you can see in : [https://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements] – Mert Akkanat Apr 27 '19 at 07:52

1 Answers1

1

It's probably because you're putting single-quotes around the field names (should be nothing since you're using fully-qualified names), and around the integers in the BETWEEN statement (should be nothing because they're numbers, not text):

SqlCommand comando = new SqlCommand(string.Format("
Select " + maskedTextBox1.Text + " , " + maskedTextBox2.Text + " 
INTO Mineria.dbo.Objeto FROM Mineria.dbo.Usuario INNER JOIN Mineria2.dbo.ARTISTA ON Mineria2.dbo.ARTISTA.Id_Artista=Mineria.dbo.Usuario.ID_Usuario 
AND Mineria.dbo.Usuario.ID_Usuario BETWEEN " + textBox1.Text + " AND " + textBox2.Text + " ORDER BY ID_Usuario ASC"), cn);
Russell Fox
  • 5,273
  • 1
  • 24
  • 28
  • The huge injection issue should really be addressed here. It's a massive security flaw in the OP's code, and is just a matter of time before it's exploited. – Thom A Apr 27 '19 at 11:22
  • Assuming this code is accessible from the outside world, yes. – Russell Fox Apr 29 '19 at 15:59