OdbcDataReader.Read() returns false

[khalid Ahmed]

I'm attempting to execute a SQL SELECT query but it doesn't seem to be returning any records. I've confirmed that the connection is actually opening and when I tried to execute the same query on mysqL server it returns results. but when I execute the query in my project without using OdbcParameter, it returns the result as expected.
Here is my code...

            // connection string declaration
            string connstr = @"Driver={MySQL ODBC 3.51 Driver};Server=localhost;Database=logsdb; User=root;Password=12345;Option=3;";
            // instantiate the connection
            OdbcConnection odbc_conn = new OdbcConnection(connstr);
            OdbcDataReader odbc_reader=null;
 
                // open the connection
                odbc_conn.Open();
                string query_stmt = "SELECT * FROM logsdb.userslog  WHERE (uname=@user & pw=@password )";
 
                // Declare command object with paramater
                OdbcCommand odbc_command = new OdbcCommand(query_stmt, odbc_conn);
                // define the paramaters used in command object
                OdbcParameter user_param = new OdbcParameter("@user", TextBoxusr.Text);
                OdbcParameter pw_param = new OdbcParameter("@password", TextBoxpw.Text);
                // add paramater to command object
                odbc_command.Parameters.Add(user_param);
                odbc_command.Parameters.Add(pw_param);
                // get the query result
                odbc_reader = odbc_command.ExecuteReader();
                // check the query result
                if (odbc_reader.Read() )
                {
                    string user=(string)odbc_reader["uname"];
                    string pw= (string)odbc_reader["pw"];
                }
             finally
             {
                if (odbc_reader != null)
                    odbc_reader.Close();
                if (odbc_conn != null)
                    odbc_conn.Close();
             }

So why odbc_reader.Read() returns false?

[kenobewan]

Are uname=@user & pw=@password correct? Are your field names really uname & pw? Have you used validation?

[khalid Ahmed]

Are uname=@user & pw=@password correct? Are your field names really uname & pw? Have you used validation?

yes, fields names are uname and pw,I tried to execute the same query ( without using parameters ) and it returns results.
like this:
string query_stmt = @"SELECT * FROM logsdb.userslog WHERE uname= '" + TextBoxusr.Text + "'"+ "& pw='"+TextBoxpw.Text+"'";
OdbcCommand odbc_command = new OdbcCommand(query_stmt, odbc_conn);

I know that this is a bad query cuz it invites hackers to replace that textBox string value with something malicious.

so, why when I use OdbcParameter with OdbcDataReader returns false?????

pls can anyone help me.......

[kenobewan]

ODBC parameters are not named, they are positional and question marks are used as placeholders. The parameters must be added in the order they appear in your quert.

Here is an example:

myCommand.CommandText="SELECT * FROM Table WHERE Colomn = ?" 
 
int value = 4; 
 
OdbcParameter myParameter = new OdbcParameter(); 
 
myParameter.DbType = DbType.Int32; 
 
myParameter.OdbcType = OdbcType.Int; 
 
myParameter.Size = 4; 
 
myParameter.Value=value;
 
myCommand.Parameters.Add(myParameter);
 

[khalid Ahmed]

ODBC parameters are not named, they are positional and question marks are used as placeholders. The parameters must be added in the order they appear in your quert.

Here is an example:

myCommand.CommandText="SELECT * FROM Table WHERE Colomn = ?" 
 
int value = 4; 
 
OdbcParameter myParameter = new OdbcParameter(); 
 
myParameter.DbType = DbType.Int32; 
 
myParameter.OdbcType = OdbcType.Int; 
 
myParameter.Size = 4; 
 
myParameter.Value=value;
 
myCommand.Parameters.Add(myParameter);
 

kenobewan
WOW!!! You are wonderful. Thanks a million

[kenobewan]

kenobewan
WOW!!! You are wonderful. Thanks a million

No problem, 999,999 thanks would have been sufficient ;).