Question

This is my code:

This is in a different class named DBAccess

public DataSet getRecords(DateTime dtpFloor,DateTime dtpCeiling)
{

   if (conn.State.ToString() == "Closed")
            {
                conn.Open();
            }

   SqlCommand newCmd = conn.CreateCommand();

   newCmd.Connection = conn;

   newCmd.CommandType = CommandType.Text;

   newCmd.CommandText = " SELECT * FROM dbo.ClientInvoice  WHERE invDate BETWEEN  '" + dtpCeiling + "' AND  '" + dtpFloor + "'";

            SqlDataAdapter da = new SqlDataAdapter(newCmd);

            DataSet dsIncome = new DataSet();

            da.Fill(dsIncome, "Client");

             conn.Close();

            return dsIncome;

}

Below Coding is in the ProfitLos form class

public void btnClickFillGrid()
{

    DataSet dsIncome =     dba.getRecords(dtpFloor.Value.ToString(),    dtpCeiling.Value.ToString()); //dba is an object of DBAccess class

    dgvproIncome.DataSource = dsIncome.Tables["Client"].DefaultView;

}

btnClickFillGrid() will invoke at the button click event.

In the database – invdate datetime;(invDate is the variable name and its in the datetime format)

i edited my coding like this

public DataSet getRecords(DateTime dtpFloor,DateTime dtpCeiling)
        {
            using (SqlConnection conn = new SqlConnection("Data Source=KOSHITHA-PC;Initial Catalog=ITP;Integrated Security=True"))
            {
                 conn.Open();
                 using (SqlCommand command = conn.CreateCommand())
                 {
                     string sql = "SELECT * FROM dbo.ClientInvoice WHERE invDate BETWEEN" + "@from AND @to"; 
            command.CommandText = sql;
            command.Parameters.AddWithValue("@from",dtpFloor);
            command.Parameters.AddWithValue("@to", dtpCeiling);

            SqlDataAdapter da = new SqlDataAdapter(command);
            DataSet dataSetClient = new DataSet();
            da.Fill(dataSetClient, "Client");
            return dataSetClient;
                }
            }
        }


DataSet dataSetClient = dba.getRecords(dtpFloor.Value, dtpCeiling.Value);
                dgvproIncome.DataSource = dataSetClient.Tables["Client"].DefaultView;

now i m getting an exception in “da.Fill(dataSetClient, “Client”);” line saying
sqlException was unhandled
An expression of non-boolean type specified in a context where a condition is expected, near ‘BETWEEN@from’.

i m not familiar with the parameter passing method to sql query,so couldnt find the problem that i m having

Answer 1

Look at this call:

dba.getRecords(dtpFloor.Value.ToString(), dtpCeiling.Value.ToString());

That’s clearly passing in strings as the arguments. Now look at your method declaration:

public DataSet getRecords(DateTime dtpFloor,DateTime dtpCeiling)

Those parameters are of type DateTime, not string. So the first thing to fix is the call, to:

dba.getRecords(dtpFloor.Value, dtpCeiling.Value);

Now the next problem is that you’re embedding the values in the SQL directly. Don’t do that. Never do that. In some cases it can lead to SQL injection attacks, and in other cases it causes data conversion issues (as you’ve got here). Use parameterized SQL instead – oh, and use connection pooling rather than trying to use a single connection in multiple places:

public DataSet GetRecords(DateTime dtpFloor,DateTime dtpCeiling)
{
    using (SqlConnection conn = new SqlConnection(connectionString))
    {
        conn.Open();
        using (SqlCommand command = conn.CreateCommand())
        {
            string sql = "SELECT * FROM dbo.ClientInvoice WHERE invDate BETWEEN "
                       + "@from AND @to";
            command.CommandText = sql;
            command.Parameters.AddWithValue("@from", dtpFloor");
            command.Parameters.AddWithValue("@to", dtpCeiling");

            SqlDataAdapter da = new SqlDataAdapter(command);
            DataSet dataSet = new DataSet();
            da.Fill(dataSet, "Client");
            return dataSet;
        }
    }
}