Data Search In SQL Database

Question

Hi, i want user to type a string in textbox, and i will search, if textbox.text exists in my SQL database table or not. Below is the code i'm using :---------------
 string txtname = (txtEmpName.Text).Trim();
 sQuery = "select * from tbUser where UserName='_username'";
 sQuery = sQuery.Replace("_username", txtname);
 SqlConnection objConnection = new SqlConnection(source);
 objDataAdapter = new SqlDataAdapter(sQuery,objConnection);
// DataTable dtTable = new DataTable();
 if (objConnection.State  == ConnectionState.Closed)
 objConnection.Open();
 objDataSet = new DataSet();
 objDataAdapter.Fill(objDataSet);
// objDataAdapter.Fill(dtTable);
or i want to search if "txtname" exists in "tbUser" table.
Thanks & Regards.
Manish S. Anand

Answer 1

This is a very poor coding, Unfortunately not fit anywhere :-(
This code is a security risk (sql injection)!
He should use SqlCommand class with parameters!
but yet if i understand the problem he is facing, then the problem is in the SQL part of the code and not the Dot.net :-) therefor it is fit to this forum. Basically the code should work, but as i understand from him his problem is in the
result set come back from the query filter. If so:
* the problem is that he use:
where UserName='_username'
instead of:
where UserName='%_username%'
and he do ask about the search problem :-)
[Personal Site] [Blog] [Facebook]