Hi RichardSa,

I would suggest to use parameterized query instead of concatenation.

private void PopulateBlog()
{
    SqlConnection con = new SqlConnection("Data Source=(LocalDB)\\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\\Dataregister.mdf;Integrated Security=True");
    con.Open();
    SqlCommand cmd = new SqlCommand();
    cmd.CommandText = "SELECT [Heading],[Title],[Body] FROM [Guide] WHERE [Title] = @Title";
    cmd.Parameters.AddWithValue("@Title", Request.QueryString["Id"]);
    cmd.Connection = con;
    SqlDataAdapter sda = new SqlDataAdapter();
    DataSet ds = new DataSet();
    sda.SelectCommand = cmd;
    sda.Fill(ds, "detail");
    if (ds.Tables[0].Rows.Count > 0)
    {
        maintitle.Text = ds.Tables[0].Rows[0]["Heading"].ToString();
        subtitle.Text = ds.Tables[0].Rows[0]["Title"].ToString();
        body.Text = ds.Tables[0].Rows[0]["Body"].ToString();
    }
}

Hi dharmendr,

Using parameterized query; I tried this and its error

    private void PopulateBlog()
    {
        SqlConnection con = new SqlConnection("Data Source=(LocalDB)\\MSSQLLocalDB;AttachDbFilename=|DataDirectory|\\Dataregister.mdf;Integrated Security=True");
        SqlDataReader dr;
        using (SqlCommand cmd = new SqlCommand())
        {
            cmd.Parameters.Clear();
            cmd.CommandText = "SELECT [Heading],[Title],[Body] FROM [Guide] WHERE [Title] = '" + Request.QueryString["Id"] + "'";
            cmd.Parameters.AddWithValue("@Heading", maintitle.Text);
            cmd.Parameters.AddWithValue("@Title", subtitle.Text);
            cmd.Parameters.AddWithValue("@Body", body.Text);
            cmd.Connection = con;
            con.Open();
            dr = cmd.ExecuteReader();
            if (dr.HasRows)
            {
                maintitle.Text = dr.GetValue(1).ToString();
                subtitle.Text = dr.GetValue(2).ToString();
                body.Text = dr.GetValue(3).ToString();
            }
        }
    }

RichardSa says:

 cmd.CommandText = "SELECT [Heading],[Title],[Body] FROM [Guide] WHERE [Title] = '" + Request.QueryString["Id"] + "'";

           cmd.Parameters.AddWithValue("@Heading", maintitle.Text);

           cmd.Parameters.AddWithValue("@Title", subtitle.Text);

           cmd.Parameters.AddWithValue("@Body", body.Text);

You need to set parameterized query for Title.

For more details refer the article.

Parameterized Queries ADO.Net