mysql - c# MySqlCommand.Parameters.AddWithValue, parameters to express a table, resulted command have a single quote added -
my problem 2 undesired single quote appear in command when use addwithvalue. how call function:
string sqltablename = "the_table_i_want"; datatable mydatatable = sqlcom.selectlastvalueintab(sqltablename);
my function;
public static datatable selectlastvalueintab(string tablename) { using (mysqlconnection con = new mysqlconnection(connstr)) { using (mysqlcommand mycommand = new mysqlcommand("select * @tabname order id desc limit 1", con)) { mycommand.parameters.addwithvalue("@tabname", tablename); try { con.open(); mysqldatareader testreader = mycommand.executereader();
the resulted command :
"select * 'the_table_i_want' order id desc limit 1"
and suppose :
"select * the_table_i_want order id desc limit 1"
it cause program crash beacause have:
a syntax error near ''the_table_i_want' order id desc limit 1'
ps : if don't use addwithvaluechange , change
@tabname the_table_i_want
in mysqlcommand works !
thanks lot !
daniel g.b
as comments suggest, cannot use parameters express table or field name. alternative approach appending table name query.
public static datatable selectlastvalueintab(string tablename) { using (mysqlconnection con = new mysqlconnection(connstr)) { string qry = "select * " + tablename + " order id desc limit 1"; using (mysqlcommand mycommand = new mysqlcommand(qry, con)) { try { con.open(); mysqldatareader testreader = mycommand.executereader();
Comments
Post a Comment