Parameterized Query for MySQL with C#

Question

I have the code below (I've included what I believe are all relevant sections):

private String readCommand = "SELECT LEVEL FROM USERS WHERE VAL_1 = ? AND VAL_@ = ?;"; public bool read(string id) {     level = -1;     MySqlCommand m = new MySqlCommand(readCommand);     m.Parameters.Add(new MySqlParameter("", val1));     m.Parameters.Add(new MySqlParameter("", val2));     MySqlDataReader r = m.ExecuteReader();     if (r.HasRows)         level = Convert.ToInt32(r.GetValue(0).ToString());     r.Close();     return true; } 

When I run this, I get an IndexOutOfBoundsException on adding the first parameter. What have I done wrong?

Answer 1

Try this instead:

private String readCommand =               "SELECT LEVEL FROM USERS WHERE VAL_1 = @param_val_1 AND VAL_2 = @param_val_2;";  public bool read(string id) {     level = -1;     MySqlCommand m = new MySqlCommand(readCommand);     m.Parameters.AddWithValue("@param_val_1", val1);     m.Parameters.AddWithValue("@param_val_2", val2);     level = Convert.ToInt32(m.ExecuteScalar());     return true; } 

Answer 2

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e) {     MySqlConnection con = new MySqlConnection("server=localhost;User Id=root;database=result;password=1234");     con.Open();      MySqlCommand cmd = new MySqlCommand("Select * from users where username=?username and password=?password", con);     cmd.Parameters.Add(new MySqlParameter("username", this.Login1.UserName));     cmd.Parameters.Add(new MySqlParameter("password", this.Login1.Password));       MySqlDataReader dr = cmd.ExecuteReader();     if (dr.HasRows ==true)     {         e.Authenticated = true;     } }