Gridview filling at runtime

[malli kai]

Hi!
I want to fill the GridView at Runtime.
For that I am using the following code:

SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["Dmo_SubConnectionString"].ConnectionString);
string str = 
"SELECT M.Pat_Id, M.Pat_First, R.Reg_ID, R.Ent_Date, M.Emp_Name FROM PAT_REG AS R INNER JOIN PAT_MAST AS M ON R.Pat_ID = M.Pat_Id WHERE R.Ent_Date BETWEEN '" + 
  drtextbox1.Text + 
  "' AND '" + 
  drtextbox2.Text + "'";
 
DataSet ds = new DataSet();
con.Open();
SqlDataAdapter da = new SqlDataAdapter(str, con);
da.Fill(ds);
GridView1.DataSource = ds.Tables[0];
GridView1.DataBind();

Then no error is occur and no output is occur.
What I do?
Please help me.

Thanks in advance.

[Frinavale]

It sounds like you aren't retrieving any data from your database.

Try doing SELECT * FROM PAT_REG to see if you get any data.

You should not be inserting text that the user provided into your SQL queries. This leaves you open to something called an Insertion Attack (or Injection Attack).

Create a SqlCommand object for your query. Supply your query to the SqlCommand and use the SqlCommand's Parameters property to add the input that the user provided to the query. The SqlCommand will then treat the user's input as "Literal" data instead of part of the command (as you have it)

Set the SqlDataAdapter.SelectCommand Property to the SqlCommand you have instantiated and configured it.

-Frinny