Question

protected void btnFind_Click(object sender, EventArgs e)
{
    if (zipcode.Text != "")
    {
        litAddress.Text = "";
        litAddress1.Text = "";
        string addressstring = zipcode.Text;

        SqlConnection conn1 = new SqlConnection("Data Source=win2008-2;Initial Catalog=h1tm11;User ID=sa;Password=password;Persist Security Info=True;");
        SqlCommand cmd = new SqlCommand("Select lat,lng from tbl_pincode where codes='" + addressstring + "'", conn1);
        DataTable table = new DataTable();
        SqlDataAdapter adapter = new SqlDataAdapter(cmd);
        adapter.Fill(table);

        foreach (DataRow row in table.Rows)
        {
            string lat = row["lat"].ToString();
            string lng = row["lng"].ToString();

            string connstring = "Data Source=win2008-2;Initial Catalog=h1tm11;User ID=sa;Password=password;Persist Security Info=True;";
            SqlConnection conn = new SqlConnection(connstring);
            string SQL1 = "SELECT  *, 6371.01 * ACOS( SIN( CAST((lat) AS float)*PI()/180 ) * SIN( CAST((store_lat) AS float)*PI()/180 ) + COS( CAST((lat) AS float)*PI()/180 ) * COS( CAST((store_lat) AS float)*PI()/180 ) * COS( (CAST((store_long) AS float)*PI()/180) - (CAST((lng) AS float)*PI()/180) ) ) AS distance from storelocator where 6371.01 * ACOS( SIN(CAST((lat) AS float)*PI()/180 ) * SIN( CAST((store_lat) AS float)*PI()/180 ) + COS(CAST((lat) AS float)*PI()/180 ) * COS( CAST((store_lat) AS float)*PI()/180 ) * COS( (CAST((store_long) AS float)*PI()/180) - (CAST((lng) AS float)*PI()/180) ) ) < '" + ddl_distance.SelectedItem.Value + "' order by distance asc;";
            conn.Open();
            SqlCommand comm = new SqlCommand(SQL1, conn);
            SqlDataReader reader = comm.ExecuteReader();
            while (reader.Read())
            {
                string area = reader["store_name"].ToString();
                string codes = reader["store_address1"].ToString();
                litAddress.Text += area + "<br>";
                litAddress1.Text += codes + "<br>";
            }
        }
    }
}

I am getting an invalid column name lat,lat,lng,lat,lat,lng error.I think it is not taking the lat,lng value in the sql query, but I’m passing it. I have also converted the string to float. The datafield in my database is nvarchar for lat,lng,store_lat and store_long. I don’t know why.

Answer 1

u cross check once, all the column name. and try to rename with good naming convention, so that it will not lead to error.

this is not the right way to add parameter to your query, it will be error prone.. Exploits of SqlInjectio ,
you should use parameterized query. and also dont use

SELECT * from table name ,

you use how much column needed to display your logic, it will help to speed up the processing.

        SqlCommand cmd = new SqlCommand("Select lat,lng from tbl_pincode wherecodes=@address", conn1);
        cmd.Parameters.AddWithValue("@address",  addressstring ); 
        DataTable table = new DataTable();
        SqlDataAdapter adapter = new SqlDataAdapter(cmd);
        adapter.Fill(table);