Fix the exception System.Data.SqlClient.SqlException: 'Incorrect syntax near '='.'

Question

When I run the ide show the following exception

System.Data.SqlClient.SqlException: 'Incorrect syntax near '='.'

string query = "SELECT * FROM lwpos_categories  WHERE parent_id=" + ddlCategory.SelectedValue;

Don't concatenate the string value, use a parameter instead. — jarlh, Nov 25 '19 at 11:21
What data type is parent_id. What is the value of ddlCategory.SelectedValue? — d219, Nov 25 '19 at 12:06
this shows you the parameter method: https://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements — smoore4, Nov 25 '19 at 14:57

score 0 · Accepted Answer · edited Nov 25 '19 at 14:32

0

Probably ddlCategory.SelectedValue is empty. The following can fix this exception (and I recommend using SqlParameters).

string query = "SELECT * FROM lwpos_categories  WHERE parent_id= '" + ddlCategory.SelectedValue + "'";

edited Nov 25 '19 at 14:32

d219

answered Nov 25 '19 at 12:32

Serkan Arslan

2

I think it would have been better to give a really, really strong warning about why this code is dangerous rather than just mentioning `SqlParameter` in parentheses, as if it's something that's not really important. – Jon Skeet Nov 25 '19 at 14:35

1 Answers1