Question

I want to make certain query to mysql from C# so I can get back for example name and lastname.

I don’t know how to handle this in c# and I want to minimize sqlinjection.

Here is my code:

con = new MySqlConnection("server=localhost;database=Customers;uid=root;pwd=******");
con.Open();
cmd = new MySqlCommand("SELECT name,lastname FROM customer WHERE ID_customer= ?Parname;", con);
cmd.Parameters.Add("?Parname", MySqlDbType.Float).Value = customer_card;
cmd.ExecuteNonQuery();
con.Close();

I want to be able for example to read results and it will be only one result, in the 2 string variables. How to get trough the data and save it?

Thank you

Answer 1

A cheating but quick way of getting several strings out of a query returning one row would be as follows:

con = new MySqlConnection("server=localhost;database=Customers;uid=root;pwd=******");
try {
    con.Open();
    cmd = new MySqlCommand("SELECT concat(name,'|',lastname) FROM customer WHERE ID_customer= ?Parname;", con);
    cmd.Parameters.Add("?Parname", MySqlDbType.Float).Value = customer_card; // Are you sure that the ID is float? That's the first time I see anything like that!
    var tokens = ((String)cmd.ExecuteScalar()).Split('|');
    var firstName = tokens[0];
    var lastName = tokens[1];
    Console.Writeln("First={0}, Last={1}", firstName, lastName);
} finally {
    con.Close();
}

The idea is to combine both strings into one on the MySql side, and split them back on the C# side. This trick lets you avoid looping through a reader, closing it, and so on. It assumes that the names do not contain '|' characters.