ASP.Net Webpages/SQL Query question

Associate
Joined
20 Nov 2010
Posts
1,409
Location
Manchester
Been looking at writing a few simple webpages to display KPI information from an SQL server database and come across an issue when trying to set up an orderbook search page.

I basically have a text box on a page which I want to query the database to return job numbers which match the entry. At the moment to make things simple I just want to search on JobNumber and return that and Outstanding Qty.

I keep getting an error 'Conversion failed when converting the nvarchar value '7036/10' to data type int'. I know this is because the job number field has none integers, if I switch the parameter to oustanding_qty I can search on that fine.

It's definitely something massively simple, but being a noob i just can't see what it is?


My current code is in the spoiler tags. It is something to do with the way i am either defining the JobNumber input or referencing it in the query.


@{Layout="Layout.cshtml";
var db = Database.Open("*****");
string JobNumber = Request.Form["JobNumber"];
var OrderbookQuery = @"
SELECT Orde_Goods.Alternate_Job_Number, ORDE_Goods.Outstanding_Qty FROM ORDE_Goods WHERE ((ORDE_Goods.Outstanding_Qty>0)) AND (Orde_Goods.Alternate_Job_Number="+JobNumber+")";
}

<!doctype=html>
<html><head>
<link rel="stylesheet" type="text/css" href="Site.css">
</head>
<body>
<form method="post" action="">
<fieldset>
<legend>Select Job No.</legend>
<div>
<label>Job Number</label>
<input name="JobNumber" type="text" size="5" value="@JobNumber"/>
</div>
<div>
<label>&nbsp;</label>
<input type="submit" value="Submit" class="submit" />
</div>
</fieldset>
</form>

@{if(IsPost)
{
<table border="1">
<tr>
<th>Job Number</th>
<th>Outstanding Qty</th>
</tr>
@foreach(var row in db.Query(OrderbookQuery))
{
<tr>
<td>@row.Alternate_Job_Number</td>
<td>@row.Oustanding_Qty</td>
</tr>
}
</table>
}
}
</body>
</html>
 
Associate
OP
Joined
20 Nov 2010
Posts
1,409
Location
Manchester
Yes that was my next step - I have replaced the two lines with

Orde_Goods.Alternate_Job_Number =@0
and
@foreach(var row in db.Query(OrderbookQuery, JobNumber))

Which seems to work fine - this would avoid the problem of injection right?
 
Back
Top Bottom