Question

I have problem with my SqlCommand everything I open the page I get the error:

System.Data.SqlClient.SqlException: Incorrect syntax near 'Van'.

I cannot find the problem because ‘Van’ is only found once in the entire project, and in the title..
This is my code in the Page_Load:

   using (SqlConnection con = new SqlConnection(RoleEnvironment.GetConfigurationSettingValue("DatabaseConnectionString")))
            {
                var cmd = new SqlCommand("SELECT (SELECT Memo_ID, Dep_Name FROM Department WHERE (Department_ID = Staff.Depar_ID)) AS DepartmentName FROM Staff WHERE (FirstName + SPACE(1) + LastName = " + User.Identity.Name, con);
                cmd.Connection.Open();
                var sqlReader = cmd.ExecuteReader();
                while (sqlReader.Read())
                {

                    String result = sqlReader.GetString(0);
                    DropDownList1.DataBind();
                    DropDownList1.Items.FindByValue(result).Selected = true;
                    //Fill some data like : string result = sqlReader("SomeFieldName");
                }
                sqlReader.Close();
                cmd.Connection.Close();
                cmd.Dispose();
            }

The database connectionstring is correct because it works for all my other pages.. i’m trying to get the department where an employee works so he/she can only view memo’s from their own department.

Answer 1

You need to close the parentheses after the last name provided.

SELECT (SELECT Memo_ID, Dep_Name FROM Department 
WHERE (Department_ID = Staff.Depar_ID)) AS DepartmentName 
FROM Staff WHERE (FirstName + SPACE(1) + LastName = 'xxx' )

Here is what it should look like:

  using (SqlConnection con = new SqlConnection(RoleEnvironment.GetConfigurationSettingValue("DatabaseConnectionString")))
        {
            var cmd = new SqlCommand("SELECT (SELECT Memo_ID, Dep_Name FROM Department WHERE (Department_ID = Staff.Depar_ID)) AS DepartmentName FROM Staff WHERE (FirstName + SPACE(1) + LastName = '" + User.Identity.Name + "')", con);
            cmd.Connection.Open();
            var sqlReader = cmd.ExecuteReader();
            while (sqlReader.Read())
            {

                String result = sqlReader.GetString(0);
                DropDownList1.DataBind();
                DropDownList1.Items.FindByValue(result).Selected = true;
                //Fill some data like : string result = sqlReader("SomeFieldName");
            }
            sqlReader.Close();
            cmd.Connection.Close();
            cmd.Dispose();