7

I have an Accounts table with columns name, password and email. They are all type nvarchar. I wrote a query like

SELECT name, password, ISNULL(email, 'eeee') 
FROM Accounts 
WHERE name = '" + textBox1.Text + "' AND password ='" + textBox2.Text + "'"

I read the email as reader.getString(2) since it is nvarchar.

As I read from the internet, if email is NULL, then it should return eeee. But it says System.boolean can not be translated to System.String.

How can I correct this? Why does it return a boolean value?

Richard II
  • 853
  • 9
  • 31
Ada
  • 624
  • 3
  • 17
  • 31
  • 4
    Sweet SQL injection you've got going on there – ta.speot.is May 04 '11 at 23:19
  • I think you wanted `ifnull()` – Kevin Peno May 04 '11 at 23:21
  • when i try ifnull, it doesn't recognize the function. on internet it says it is mysql, not microsoft sql server. – Ada May 04 '11 at 23:23
  • 1
    Read this: http://xkcd.com/327/ to get an idea of what SQL injection is and can do to your system, if you concatenate together your SQL statement without checking anything..... you should use **parametrized queries** instead! – marc_s May 05 '11 at 05:03

1 Answers1

17

According this ISNULL is not implemented in SQL Server CE. I would expect to see a syntax error raised, however.

Workaround: you can use CASE WHEN email IS NULL THEN 'eeee' ELSE email END or COALESCE. Preferably the latter.

Also use parameterised queries. If you don't know why you should, learn.

Kissaki
  • 8,810
  • 5
  • 40
  • 42
ta.speot.is
  • 26,914
  • 8
  • 68
  • 96