use of unassigned local variable "acc_pay"

Question

here is a piece of code where i used this variable float acc_pay; float x = float.Parse(tb_quantity.Text) * float.Parse(tb_Price.Text);

        if (comboBox1.Text == "OK")
        {
            acc_pay = 0;
        }
        else if (comboBox1.Text == "NOT OK")
        {

            acc_pay = x;
        }
        else
        {
            MessageBox.Show("Select Any Status ...", "Warining", MessageBoxButtons.OK, MessageBoxIcon.Warning);

        }


        con.Open();
            String query = "INSERT INTO tbl_insertData(Name,Quantity,Unit_Price,Net_Cash,Acc_Payable,Status,Date) VALUES(" +
                "'" + tb_Item_Name.Text + "'," + 
                "'" + tb_quantity.Text + "'," +
                "'" + tb_Price.Text + "'," +
                "'" + tb_Net_Cash.Text + "'," +
                "'" + acc_pay + "'," + //here is error generated on "acc_pay" variable
                "'" + comboBox1.Text + "'," +
                "'" + tb_Date.Text + "')";
            SqlDataAdapter adp = new SqlDataAdapter(query, con);
            adp.SelectCommand.ExecuteNonQuery();
            con.Close();

Use parameterised queries! This is wide open to SQL injection — Martin Smith, Apr 28 '20 at 14:28
Compiler is not so much intelligent and never believes that if Else statement will execute or not..so we must have to initialize the local variable... — Muhammad Awais, Apr 28 '20 at 14:33
The compiler is perfectly capable of working this out. But you don't assign it in the `MessageBox.Show` branch - **and you still have the gaping security hole with SQL injection** — Martin Smith, Apr 28 '20 at 14:44
I did't get it sr, what does it mean by sql injection and where it is in my code and how i can resolv it — Muhammad Awais, May 04 '20 at 06:25

use of unassigned local variable "acc_pay"

0 Answers0