Member 14680372 wrote:
string sql = " select * from comboboxnew where code = '" + comboBox1.SelectedItem + "';";
Don't do it like that! Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query. Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^] How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^] Query Parameterization Cheat Sheet | OWASP[^]
private void ComboBox1_SelectionChanged(object sender, SelectionChangedEventArgs e)
{
using (SqlConnection con = new SqlConnection("Data Source=LEAN-22\\SQLEXPRESS;Initial Catalog=LUAT;Integrated Security=True"))
using (SqlCommand cmd = new SqlCommand("SELECT TOP 1 * FROM comboboxnew WHERE code = @code;"))
{
cmd.Parameters.AddWithValue("@code", Convert.ToString(comboBox1.SelectedItem));
con.Open();
using (SqlDataReader myreader = cmd.ExecuteReader(CommandBehavior.CloseConnection))
{
if (myreader.Read())
{
string code = myreader.GetInt32(0).ToString();
string pieces = myreader.GetInt32(1).ToString();
string layers = myreader.GetInt32(2).ToString();
string productionpieces = myreader.GetInt32(3).ToString();
string seccond = myreader.GetInt32(4).ToString();
txtcode.Text = code;
txtpieces.Text = pieces;
t
