select statement with variables

[johnlarson]

I am trying to populate a datagrid from a select statement that contains variables. I can query the dbf file and get the whole file but when I try a select statement with variables from text box and combo box input the datagrid has the field names at the top but no data here is my code.

private void button2_Click ( object sender , EventArgs e )
            {
            string field = comboBox1 . Text;
            string query = textBox1 . Text;
            try
                {
                

                conString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source='" + fullPath2 + "';Extended Properties=dBase IV";
                conn = new OleDbConnection ( conString );
                command = conn . CreateCommand ( );

                dataGridView1 . DataSource = null;

                // create the DataSet
                DataSet ds = new DataSet ( );

                // open the connection
                conn . Open ( );
                // run the query
                string commandString = "Select * from ZIP.DBF where '" + field + "'='"+query+"'";
                command . CommandText = commandString;
                OleDbDataAdapter adapter = new OleDbDataAdapter (command);

                
                adapter . Fill ( ds );

                // close the connection
                conn . Close ( );

                // set the grid's data source
                dataGridView1 . DataSource = ds . Tables [ 0 ];
                }
            catch ( Exception ex )
                {
                MessageBox . Show ( ex . Message );

                }

            }

THANKS FOR ALL OF YOUR HELP

JOHN LARSON

[Plater]

Try this instead:

string commandString = "Select * from ZIP.DBF where [" + field + "]='"+query+"'";

If the column is of a numerical type, you shouldn't use ' around your value that you're testing for.

[balabaster]

Try this instead:

string commandString = "Select * from ZIP.DBF where [" + field + "]='"+query+"'";

If the column is of a numerical type, you shouldn't use ' around your value that you're testing for.

Er this is a windows forms application, right? If not, you need to be very careful with how you format your queries and should always be using parameters to pass variable data into your query and not appending query strings otherwise you leave yourself susceptible to SQL query injections.