loop through all values in sql table using sql data reader

Question

I want to fetch all rows that related to the query below, my problem that only one row retrived not all rows , iam using asp.net with c# and ado.net and my code logic is

if (!IsPostBack)
{
    string username = Session["username"].ToString();
    con.Open();
    string strqryScript = "select * from dbo.teachers where user_id = '" + username + "'";
    SqlCommand cmd = new SqlCommand(strqryScript, con);
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    SqlDataReader rdr = cmd.ExecuteReader();
    rdr.Read();         
    string name  = rdr["teach_id"].ToString();
    rdr.Close();

    string query = "select * from dbo.teacher_classes where teach_id = '" + name + "' ORDER BY class_id";
    SqlCommand cmd2 = new SqlCommand(query, con);
    SqlDataAdapter da2 = new SqlDataAdapter(cmd2);
    SqlDataReader rdr2 = cmd2.ExecuteReader();
    while (rdr2.Read())
    {
        classname.Text = rdr2["class_id"].ToString();
    }
    con.Close();
}

extra note that i can use gridview to bind data but i want to fill my table with custom information from many tables , so i want to use an html table and fill it with my custom data. any help please! and thanks ..

Please, don't create your queries composing strings!!! Use query parameters to avoid problems with international settings on dates and numbers and, above all, Sql injection!! — Marco, May 17 '13 at 15:47
Consider the following blog post about writing core ADO.NET code: http://lostechies.com/jimmybogard/2012/07/24/dont-write-your-own-orm/ — Mike Cole, May 17 '13 at 15:48
@DavidKemp The homework tag has been officially deprecated. http://meta.stackexchange.com/questions/147100/the-homework-tag-is-now-officially-deprecated — Jesse Webb, May 17 '13 at 15:49

score 4 · Answer 1 · edited May 23 '17 at 12:05

While looping on the second reader, you write the value extracted from the reader on the Text property of the classname label. This will overwrite the previous text and leave you with the name of the last teacher retrieved. You need to add to the previous text or use a List.

classname.Text += rdr2["class_id"].ToString();

Said that, let me point you to a big problem in your code. String concatenation is really bad when you build sql commands. It gives you back syntax errors (if your input text contains single quotes) or Sql Injection as explained here

You should use parameterized queries like this (just for your first command)

string strqryScript = "select * from dbo.teachers where user_id = @id";
SqlCommand cmd = new SqlCommand(strqryScript, con);
cmd.Parameters.AddWitValue("@id", username);
....

score 0 · Answer 2 · answered May 17 '13 at 15:49

0

This is the issue you need to fix:

classname.Text = rdr2["class_id"].ToString(); <== always setting the same text!!

You need to make sure, you fill a list, a dataset or whatever, when reading the data!

answered May 17 '13 at 15:49

Fabian Bigler

10,403
6
47
70

loop through all values in sql table using sql data reader

2 Answers2