William
Sun Apr 25 19:17:39 CDT 2004
Don't use concatenated dynamic sql. The reason I say this is that it causes
problems just like this, in addition to problmes if you use a field that has
a value like O'Rourke, O'Toole etc. Plus it opens you up for injection
attacks and it performs worse. Even if you are positive no one will ever
try an injection attack, you'll forget to escape a field one day (or some
other programmer will) and the problem probably won't show itself for a
while -- and it's almost always a customer that finds it.
Dynamic SQL with Concatenated fields is something that's outlived its
usefulness:
Instead:
ADataAdapter = New OleDb.OleDbDataAdapter("SELECT * FROM Contributions WHERE
'Date' > ? And 'Date < ?", AConnectionString)
mySelectCommand.Parameters.Add(CType(dtpTo.Text, DateTime))
mySelectCommand.Parameters.Add(CType(dtpFrom.Text, DateTime))
This query won't actually work though because you are using a reserved word
for a field name. You'll need to wrap Date in [] like this Where [Date] > ?
...
http://www.knowdotnet.com/articles/reservedwords.html
However, this is still a challenged approach b/c you'll always have to
remember to do this and you'll invariably forget, or another programmer
will. So I'd change the name to xxxxDate where xxx is some descriptive
name. Using reserved words for field names is very risky in general, but
ADO.NET and Reserved names (particularly with Access) don't play well
together.
HTH,
Bill
Here's another article on using Parameters. In access you use the ? mark
instead of the @ParamName (Maybe you can use Named params like that but I'm
not sure, but ? will absolutely work. Then just add the values, in the
order they appear with the ? to the command's parameters collection. You
may want to walk through the DataAdapter configuration wizard and let it
generate the Statements for you just so you can see how it declares and uses
the params. I'm not saying don't do it this way, but the wizard will
generate code and you can use that code for a learning tool)
http://www.knowdotnet.com/articles/storedprocsvb.html
"Charles A. Lackman" <Charles@cet.com> wrote in message
news:uvlJYbwKEHA.1392@TK2MSFTNGP09.phx.gbl...
> Hello,
>
> I am working with an Access Database and am trying to return a Querry
that
> is between two specified dates, I have tried the following and none of
them
> work:
>
> 1)
>
> ADataAdapter = New OleDb.OleDbDataAdapter("SELECT * FROM Contributions
WHERE
> 'Date' > " & dtpFrom.Text & " and 'Date' < dtpTo.Text & ";",
> AConnectionString)
>
> 2)
>
> ADataAdapter = New OleDb.OleDbDataAdapter("SELECT * FROM Contributions
WHERE
> [Date] BETWEEN DATEPART ('" & dtpFrom.Text & "') AND DATEPART ('" &
> dtpTo.Text & "')" , AConnectionString)
>
> 3)
>
> ADataAdapter = New OleDb.OleDbDataAdapter("SELECT * FROM Contributions
WHERE
> 'Date' > 1/1/2004 and 'Date' < 6/1/2004;", AConnectionString)
>
> No records are returned. Any suggestions will be greatly appreciated.
>
> Thanks,
>
> Chuck
>
>
>