Question

I want to find the text in textbox in my database. I wrote the code below. It finds numbers well, but when I want to find strings it gives a runtime error: invalid column name for example aaa, but aaa exists in column1 in my table.

What do you think about the problem?

    cmd = New SqlCommand("select * from tbl where column1=" + TextBox1.Text)
    cmd.CommandType = CommandType.Text
    cmd.Connection = cnn
    dad.SelectCommand = cmd
    cmd.ExecuteNonQuery()
    dad.Fill(ds)
    dgv.DataSource = ds.Tables(0)

Answer 1

That’s because the sql statement you send is not delimiting the TextBox1.Text value so you end up with this sql:

select * from tbl where column1 = aaa

and SQL Server treats aaa as a column name.

Regardless of that, you should be using a SqlParameter to avoid sql injection attacks:

cmd = New SqlCommand("select * from tbl where column1=@value") 
cmd.CommandType = CommandType.Text 
cmd.Paramaters.AddWithValue("@value", TextBox1.Text)

VB is not my primary language, so the syntax might be a little off, but you should be able to make it work.