Parameterized query with parameter in select returns invalid data

Question

I have the following code:

string connectionString = 
    "Provider=Microsoft.JET.OLEDB.4.0;" + 
    "data source=" + processProgramPath + ";";

using (OleDbConnection connection = new OleDbConnection(connectionString))
{
    connection.Open();
    using (OleDbCommand command = new OleDbCommand(
        "SELECT @Value " +
        "FROM BONDPARAMETERS " +
        "WHERE BONDPARAMETERS.SetName = @SetName", connection))
    {
        command.Parameters.AddWithValue("@Value", value);
        command.Parameters.AddWithValue("@SetName", setName);               

        var result = command.ExecuteScalar();
        return result.ToString();
    }
}

What I am expecting to get is 760 as a result. However I am getting the title for the column which is StartForce.

value = "StartForce" setName = "450(18)-F-OE"

If I change the using to this:

using (OleDbCommand command = new OleDbCommand("SELECT "+value+" " +

it works. What gives?

Thanks in advance

Community · Accepted Answer · 2017-05-23 12:14:19Z

1

You can't build SQL dynamically with parameters like that. See this question: Using C# SQL Parameterization on Column Names

edited May 23, 2017 at 12:14

CommunityBot

11 silver badge

answered Mar 22, 2013 at 23:16

TheNextman

12.6k2 gold badges41 silver badges82 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sean P Over a year ago

So would my work around be a valid way to do this then? Or is it as tacky as I feel it is?

Collectives™ on Stack Overflow

Parameterized query with parameter in select returns invalid data

1 Answer 1

1 Comment

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Linked

Related