query

[enrico via DotNetMonster.com]

Dim sSql As String = " SELECT tbltrcclient.ClientID, tbltrcclient.Lastname,
tbltrcclient.Firstname, tbltrcclient.Barangay, tbltrcclient.TypeofSeed,
tbltrcclient.TypeofArea, tbltrcclient.Hectares FROM tbltrcclient WHERE
tbltrcclient.Firstname <' '
AND tbltrcclient.Lastname LIKE " & Quote(TextBox2.Text) _
OR tbltrcclient.Firstname LIKE " & Quote(TextBox3.Text) _
OR tbltrcclient.Barangay = " & Quote(ComboBox6.Text) _
OR tbltrcclient.TypeofSeed = " & Quote(ComboBox1.Text)

If (ComboBox3.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox3.Text)
End If
If (ComboBox2.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox2.Text)
End If

myd = .runQuery(sSql)

this is my search query where a user can search whether by lastname,
firstname, etc. i put a condition that the query won't include results that
has no firstname. when i run the program it still includes those with no
firstnames but it has no errors.

--
Message posted via DotNetMonster.com
http://www.dotnetmonster.com/Uwe/For...b-net/200804/1

[Jack Jackson]

On Tue, 15 Apr 2008 04:16:52 GMT, "enrico via DotNetMonster.com"
<u41845@uwewrote:

>Dim sSql As String = " SELECT tbltrcclient.ClientID, tbltrcclient.Lastname,
tbltrcclient.Firstname, tbltrcclient.Barangay, tbltrcclient.TypeofSeed,
tbltrcclient.TypeofArea, tbltrcclient.Hectares FROM tbltrcclient WHERE
tbltrcclient.Firstname <' '
AND tbltrcclient.Lastname LIKE " & Quote(TextBox2.Text) _
OR tbltrcclient.Firstname LIKE " & Quote(TextBox3.Text) _
OR tbltrcclient.Barangay = " & Quote(ComboBox6.Text) _
OR tbltrcclient.TypeofSeed = " & Quote(ComboBox1.Text)

If (ComboBox3.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox3.Text)
End If
If (ComboBox2.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox2.Text)
End If

myd = .runQuery(sSql)

this is my search query where a user can search whether by lastname,
firstname, etc. i put a condition that the query won't include results that
has no firstname. when i run the program it still includes those with no
firstnames but it has no errors.

I think you are combining AND and OR without parentheses. You are
assuming that the backend will treat this like:

condition AND (condition OR condition OR condition)

but most lilely it does it like this:

(((conditioin AND condition) OR condition) OR condition)

But it is hard to tell because your example has many syntax errors.

[Armin Zingler]

"enrico via DotNetMonster.com" <u41845@uweschrieb

Dim sSql As String = " SELECT tbltrcclient.ClientID,
tbltrcclient.Lastname, tbltrcclient.Firstname,
tbltrcclient.Barangay, tbltrcclient.TypeofSeed,
tbltrcclient.TypeofArea, tbltrcclient.Hectares FROM tbltrcclient
WHERE tbltrcclient.Firstname <' '
AND tbltrcclient.Lastname LIKE " & Quote(TextBox2.Text) _
OR tbltrcclient.Firstname LIKE " & Quote(TextBox3.Text) _
OR tbltrcclient.Barangay = " & Quote(ComboBox6.Text) _
OR tbltrcclient.TypeofSeed = " & Quote(ComboBox1.Text)

If (ComboBox3.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " &
Quote(ComboBox3.Text) End If
If (ComboBox2.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " &
Quote(ComboBox2.Text) End If

myd = .runQuery(sSql)

this is my search query where a user can search whether by lastname,
firstname, etc. i put a condition that the query won't include
results that has no firstname. when i run the program it still
includes those with no firstnames but it has no errors.

In addition to Jack, you should really make use of the Parameters
property, but you do not even mention the database and/or technology you
are using. I did not find "runQuery" anywhere searching in "All
components" in VB IDE.
Armin

[rowe_newsgroups]

On Apr 15, 12:16 am, "enrico via DotNetMonster.com" <u41845@uwe>
wrote:

Dim sSql As String = " SELECT tbltrcclient.ClientID, tbltrcclient.Lastname,
tbltrcclient.Firstname, tbltrcclient.Barangay, tbltrcclient.TypeofSeed,
tbltrcclient.TypeofArea, tbltrcclient.Hectares FROM tbltrcclient WHERE
tbltrcclient.Firstname <' '
AND tbltrcclient.Lastname LIKE " & Quote(TextBox2.Text) _
OR tbltrcclient.Firstname LIKE " & Quote(TextBox3.Text) _
OR tbltrcclient.Barangay = " & Quote(ComboBox6.Text) _
OR tbltrcclient.TypeofSeed = " & Quote(ComboBox1.Text)

If (ComboBox3.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox3.Text)
End If
If (ComboBox2.Text <" ") Then
sSql &= " and tbltrcclient.TypeofArea = " & Quote(ComboBox2.Text)
End If

myd = .runQuery(sSql)

this is my search query where a user can search whether by lastname,
firstname, etc. i put a condition that the query won't include results that
has no firstname. when i run the program it still includes those with no
firstnames but it has no errors.

--
Message posted via DotNetMonster.comhttp://www.dotnetmonster.com/Uwe/Forums.aspx/dotnet-vb-net/200804/1

Sql Injection Anyone?

You might want to do some research on that before going live with your
code - concatenating SQL expressions is extremely dangerous. I would
highly suggest you at least use parameterized queries, if not full
blown stored procedures. These will also clean up your code greatly
and most likely fix your problem.

Thanks,

Seth Rowe [MVP]