Data not coming in SqlDataReader

Question

Well I am not able to figure out the error.No data is coming in variable SqlDataReader.The data retrieved by variable SqlDataReader is stored in Label2.

Code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;
public partial class _Default : System.Web.UI.Page
{
 protected void Page_Load(object sender, EventArgs e)
 {
 }
 protected void Button1_Click(object sender, EventArgs e)
 {
 SqlConnection con = new SqlConnection("Server=(local);Database=records;User Id=sasfddsf;Password=12345");
 try
 {
 con.Open();
 SqlCommand cmd = new SqlCommand("select id,name,referencename from records where name = '" + Label1.Text.ToString() + "'", con);
 var SqlDataReader = cmd.ExecuteReader();
 while (SqlDataReader.Read())
 {
 Label2.Text += Convert.ToString(SqlDataReader["name"]) + Convert.ToString(SqlDataReader["referenceName"]);
 }
 SqlDataReader.Close();
 }
 catch (Exception e1)
 {
 Label2.Text = "Error: " + e1.Message;
 }
 finally 
 {
 con.Close();
 }
 }
}

• ekad: Does the SQL query return any rows with the given Label1.Text value?
• Tim Schmelter: You are inviting people for sql-injection by concatenating your sql-query. Use sql-parameters instead.
• Mike Perrenoud: And what's the error?

Answer 1

Try this

 SqlCommand cmd = new SqlCommand("select id,name,referencename from records where name = @TextBoxName", con);
 com.Parameters.AddWithValue("@TextBoxName",Label1.Text.ToString()); 
 SqlDataReader rdr = cmd.ExecuteReader();
 while (rdr.Read())
 {
 Label2.Text += Convert.ToString(rdr["name"]) + Convert.ToString(rdr["referenceName"]);
 }
 rdr.Close();

• Tim Schmelter: I have no idea why this gets upvoted immediately. How is this different?
• John Saunders: @TimSchmelter: Parameters make the difference.
• Tim Schmelter: @JohnSaunders: there were no parameters in the first version, it was just the same version as OP used with different variable name for the reader. Also, even if using parameters is a good advice it's not clear why this solves the issue.
• John Saunders: @TimSchmelter: several reasons why I didn't upvote it