Question

i am using a dataset to retrieve some info from the database like this:

    protected DataSet getInfo() //getting the user info
{
    string id = Request.QueryString["User"];

    SqlCommand cmd = new SqlCommand("SELECT * FROM copy WHERE id=@id", conn());
    cmd.Parameters.AddWithValue("@id", id);

    DataSet ds = new DataSet();
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    da.Fill(ds);

    return ds;
}

   cvPage.InnerHtml = getInfo().Tables[0].Rows[0]["cv"].ToString();
   clPage.InnerHtml = getInfo().Tables[0].Rows[0]["cl"].ToString();
   bioPage.InnerHtml = getInfo().Tables[0].Rows[0]["bio"].ToString();

and it works fine until there is a number in the query string so if:

QueryString["User"] = "111111"

i will get an incorrect syntax error:

Incorrect syntax near '111111'.

but if there is no numbers it will work fine.

my database contains four columns:

id | varchar
cv | nvarchar
cl | nvarchar
bio | nvarchar

i am using asp.net 4.0.

what is the problem?

thanks

Answer 1

 SqlCommand cmd = new SqlCommand("SELECT * FROM copy WHERE id= CONVERT(varchar(4000), @id) ", conn());