SQL - OleDbCommand does not change Sql parameter

Below is the code for my select function * - it WORKS well and does everything fine until I change the SQL string from Select *From Company to

        query = "Select * From @1";

and then follow these steps

        query = "Select * From @1";
        OleDbCommand Command = new OleDbCommand(query, sqlConnStr);

        DataTable Table = new DataTable();
        DataSet dataSet = new DataSet();
        Table = null;

        //Add Parameters
        Command.Parameters.AddWithValue("@1", SQLTables.Company);

        try
        {
            Command.ExecuteNonQuery();
            adapter.SelectCommand = Command;
            adapter.Fill(dataSet);
            Table = dataSet.Tables[0];
        }
        catch (Exception e)
        {
            MessageBox.Show("A Error occured whilst trying to execute the command.\n" + e.Message);
        }

        return Table;

The DBMS continues to send "Incomplete request" - I assume that the variable Commandsends the string querywithout changing the parameter from @1toCompany


Here is the code snippet (mine) where it works. This is an insert statement, and select - correct me if I am mistaken, but if it does not work also with SELECT, and

private void MainActionsInsert(string Action, bool Checked)
{
    OleDbCommand Command = new OleDbCommand("INSERT INTO MainActions Values (ID, Action, BoolValue)", DataBaseConnection);
    //Add Parameters
    Command.Parameters.AddWithValue("ID", GenerateID());
    Command.Parameters.AddWithValue("Action", Action);
    Command.Parameters.AddWithValue("BoolValue",Checked);
    //Add Command
    MainActionsAdapter.InsertCommand = Command;
    //Execute Agains DataBase
    Command.ExecuteNonQuery();
    //Accept Changes
}

`

+3
source share
2 answers

OleDbCommand SQL From - WHERE, - . , , "". ,

    query = "Select * From Company Where @param = 1";
    OleDbCommand Command = new OleDbCommand(query, sqlConnStr);

    DataTable Table = new DataTable();
    DataSet dataSet = new DataSet();
    Table = null;

    //Add Parameters
    Command.Parameters.AddWithValue("param", "ID");

    try
    {
        Command.ExecuteNonQuery();
        adapter.SelectCommand = Command;
        adapter.Fill(dataSet);
        Table = dataSet.Tables[0];
    }
    catch (Exception e)
    {
        MessageBox.Show("A Error occured whilst trying to execute the command.\n" + e.Message);
    }

    return Table;

, Select,

+1

OLEdb . ? .

, ? .

SQL, SQL Injection. , , .

+4
source

All Articles