[NejcZ]

I'm having some troubles getting this SQL sentance to work.
I get label3.Text from other form, which is users login name.
I now must get users id with using that label.Text. What am i doing wrong? I'm getting SqlException was unhandled error - Incorect sysntax near 'MyUsername'.

What am I doing wrong? How to get queries bellow to work properly?

Thanks.

private void btnPrihod_Click(object sender, EventArgs e)
        {
           
           SqlConnection con = Program.GetConnection;
           string dobiID = "SELECT id_zaposlenega FROM tabelaZaposlenih WHERE up_ime='" + label3.Text + "'";
           string prihodSql = "INSERT INTO delavniki (id_zaposlenega, datum_ura_prihod, status_zaposlenega) VALUES ('" + dobiID + "', CURRENT_TIMESTAMP, 'na_delu')";
           SqlCommand cmd = new SqlCommand(prihodSql, con);
           cmd.ExecuteNonQuery();
           MessageBox.Show("Prijavljeni ste na delovno mesto!");
           MessageBox.Show(dobiID);



        }

[Momerath]

I don't see 'MyUsername' in that code anywhere. And use parameters or god will kill a kitten.

[NejcZ]

I get username in public Form() with:

label3.Text = Program.UserLoginName;

Ehe error is:
Incorect sysntax near 'NejcZ'

..when i'm logged in.

[Momerath]

Put a breakpoint in your code at line 6 and when it breaks look at the SQL statement in the line above. Does it look right? What is it, exactly? What is the column up_ime defined as?

[NejcZ]

To get you better idea, here is my login form:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;

namespace program
{
    public partial class Login : Form
    {
        public Login()
        {
            InitializeComponent();
            
        }

        private void btnCancel_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void btnOK_Click(object sender, EventArgs e)
        {
            SqlConnection con = Program.GetConnection;
            SqlDataReader dr = null;

            try
            {
                SqlCommand cmd = new SqlCommand("SELECT id_zaposlenega, up_ime, geslo FROM tabelaZaposlenih WHERE up_ime='" +
                    txtName.Text + "' AND geslo='" + txtpassword.Text + "'", con);
                dr = cmd.ExecuteReader();
                if (dr.Read())
                {
                    Program.UserLoginName = dr.GetString(1);
                    this.Close();
                    dr.Close();
                    new Form1().Show();


                }
                else
                    MessageBox.Show("Nepravilno uporabniško ime ali geslo!");
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);

            }
        }

    }
}

I'm using

string dobiID = "SELECT id_zaposlenega FROM tabelaZaposlenih WHERE up_ime='" + label3.Text + "'";

to get user's id (id_zaposlenega), since i don't know any other way to do that, and the i use

string prihodSql = "INSERT INTO delavniki (id_zaposlenega, datum_ura_prihod, status_zaposlenega) VALUES (" + dobiID + ", CURRENT_TIMESTAMP, 'na_delu')";

to put data in table, where id_zaposlenega should be id_zaposlenega from dobiID string. Do you know what i mean?

Thanks.

[pcaddict]

The best solution is to implement the concepts in the tutorial Parameterizing your SQL Queries: The RIGHT way to query a database

[NejcZ]

I understand that parameters are much better solution, but i'm only in phase of testing this little project, so i will stick with that code design that I'm familiar with. for now So, is there any chance to join two queries:

string dobiID = "SELECT id_zaposlenega FROM tabelaZaposlenih WHERE up_ime='" + label3.Text + "'";

string prihodSql = "INSERT INTO delavniki (id_zaposlenega, datum_ura_prihod, status_zaposlenega) VALUES (" + dobiID + ", CURRENT_TIMESTAMP, 'na_delu')";

Basicly what I need to do is get ID somehow from SQL and then use it in INSERT statement as a value. Is that even possible? In select statement i'm using label3.Text as a parameter value, becouse that is the only info I have of current user.

[Skydiver]

The brute force solution is to first execute your SELECT query to get back the ID from your id_zaposlenega column. Once you have that value, use it in a following your INSERT query.