Must declare the variable @uname

[krisssgopi]

Hi all,

When i run the below code it was throwing an exception must declare the variable @uname. please help me to solve this issue.

Try
            con.Open()
            Dim param As New SqlParameter()
            param.ParameterName = "@uname"
            param.Value = TextBox1.Text
            cmd = New SqlCommand("select * from customer where custname=@uname", con)
            da = New SqlDataAdapter(cmd)
            da.Fill(ds)
            DataGridView1.DataSource = ds.Tables(0)
        Catch ex As Exception
            MsgBox(ex.Message.ToString)
        End Try
        con.Close()

[Jim Doherty]

Hi all,

When i run the below code it was throwing an exception must declare the variable @uname. please help me to solve this issue.

Try
            con.Open()
            Dim param As New SqlParameter()
            param.ParameterName = "@uname"
            param.Value = TextBox1.Text
            cmd = New SqlCommand("select * from customer where custname=@uname", con)
            da = New SqlDataAdapter(cmd)
            da.Fill(ds)
            DataGridView1.DataSource = ds.Tables(0)
        Catch ex As Exception
            MsgBox(ex.Message.ToString)
        End Try
        con.Close()

Do you not need to concatenate the value of the variable to the string not include the name of the parameter variable itself. Look at your sql statement string again, as is it thinks @uname is a column?

[krisssgopi]

Do you not need to concatenate the value of the variable to the string not include the name of the parameter variable itself. Look at your sql statement string again, as is it thinks @uname is a column?

hi please help me. i cant able to get you. please make it in code. so that i can able to get into the clear idea.

[Jim Doherty]

hi please help me. i cant able to get you. please make it in code. so that i can able to get into the clear idea.

Pre-supposing @uname contains a numeric value then building the SQL string should look like the below should it not? rather than putting @uname inside the string as you have currently

cmd = New SqlCommand("select * from customer where custname=" & @uname, con)

if the value of @uname is text then you would further need to wrap the value in quotes so that whatever sql is fired to the server to return a recordset would be able to understand the datatype

[Curtis Rutland]

Try
            con.Open()
            cmd = New SqlCommand("select * from customer where custname=@uname", con)
            cmd.Parameters.AddWithValue("uname", TextBox1.Text);
            da = New SqlDataAdapter(cmd)
            da.Fill(ds)
            DataGridView1.DataSource = ds.Tables(0)
        Catch ex As Exception
            MsgBox(ex.Message.ToString)
        End Try
        con.Close()

This should be the proper way to do what you want.

@Jim Doherty
The way you are suggesting I do not believe will work. In the code side, the parameter has to be added to the command object, not the command text.

Also, string concatenation leaves you vulnerable to SQL Injection attacks. Using a parameter like the way I mentioned protects you from that.

[Jim Doherty]

Try
            con.Open()
            cmd = New SqlCommand("select * from customer where custname=@uname", con)
            cmd.Parameters.AddWithValue("uname", TextBox1.Text);
            da = New SqlDataAdapter(cmd)
            da.Fill(ds)
            DataGridView1.DataSource = ds.Tables(0)
        Catch ex As Exception
            MsgBox(ex.Message.ToString)
        End Try
        con.Close()

This should be the proper way to do what you want.

@Jim Doherty
The way you are suggesting I do not believe will work. In the code side, the parameter has to be added to the command object, not the command text.

Also, string concatenation leaves you vulnerable to SQL Injection attacks. Using a parameter like the way I mentioned protects you from that.

We learn something new every day I stand corrected :)