Question

I realise this question has been asked before, but after going through the previously answered questions, i still can’t quite figure out what’s wrong with this code.

FYI I am in the UK.

   public static void GetDataForCSEP(string viewName, string schemaName, 
                                             string dateFieldName, DateTime startDate, DateTime endDate)
        {

            string dateFormat = "yyyy/MM/dd HH:mm:ss";


            //Connect to SQl Server 

            string commandText = "SELECT * FROM " + schemaName + "." + viewName + " WHERE @dateFieldName BETWEEN @startDate AND  @endDate";


            using (SqlCommand sqlCmd = new SqlCommand(commandText,sql_Conn))
            {
                sqlCmd.CommandType = CommandType.Text;

                sqlCmd.Parameters.Add("@dateFieldName",SqlDbType.NVarChar, 30).Value = dateFieldName;
                sqlCmd.Parameters.Add("@startDate", SqlDbType.DateTime).Value = DateTime.Parse(startDate.ToString(dateFormat));
                sqlCmd.Parameters.Add("@endDate", SqlDbType.DateTime).Value = DateTime.Parse(startDate.ToString(dateFormat));



                sql_Conn.Open();
                sqlCmd.ExecuteNonQuery();


            }
}

Answer 1

On Error is you cannot pass column name as parameter

    "SELECT * FROM " + schemaName + "." + viewName + " 
WHERE @dateFieldName BETWEEN @startDate AND  @endDate";

this should be

    "SELECT * FROM " + schemaName + "." + viewName + " 
WHERE " + dateFieldName  + " BETWEEN @startDate AND  @endDate";

To avoid sqlInjection attack make use of Sp_executeSQL to execute this type of query, because this is dynamic sql query.