title: ASP.NET SqlDataReader Incorrect syntax near
body: <p>I've had an ASP.NET page that had worked for quite a while, up until recently. The page contains a single text box (<code>TextBox1</code>) and a submit button. When you input (or scan) a number into the field and submit it, if the record exists in the database and hasn't been submitted before, it adds a date/time stamp to another column and gives the user feedback that it's been recorded. If the record exists and already had a date/time stamp, it doesn't change anything but gives the user feedback that the record already has been input or scanned. If the record doesn't exist, it gives the user feedback that there is no such record.</p>
  
  <p>This all worked fine when I was inputting numerical values. Now, the numeric values have changed to alphanumeric and I'm getting and error. Anytime I input a value that is alphanumeric, I get an </p>
  
  <blockquote>
    <p>Incorrect syntax near 'x'</p>
  </blockquote>
  
  <p>error that refers to line 35:</p>
  
  <pre><code>using(SqlDataReader reader = command.ExecuteReader())
  </code></pre>
  
  <p>My entire code from my aspx.cs file is below. Any suggestions are greatly appreciated!</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Configuration;
  using System.Data;
  using System.Data.SqlClient;
  using System.Web;
  using System.Web.UI;
  using System.Web.UI.WebControls;
  
  public partial class _Default : System.Web.UI.Page
  {
      private string GetConnectionString()
      {
          return ConfigurationManager.ConnectionStrings["MyConnectionString"].ConnectionString;
      }
  
      protected void Button1_Click(object sender, EventArgs e)
      {
          using (SqlConnection connection = new SqlConnection(GetConnectionString()))
          {
              try
              {
                  connection.Open();
  
                  string sql = @"SELECT PRODUCT_ID from PRODUCTS where PRODUCT_ID = " + TextBox1.Text + " and DATE is null";
  
                  using(SqlCommand command = new SqlCommand(sql, connection))
                  {
                      using(SqlDataReader reader = command.ExecuteReader())
                      {
                          if(reader.HasRows)
                          {
                              string sql2 = @"UPDATE [products] SET date=@Value2 where PRODUCT_ID=@Value1";
                              using (SqlCommand command2 = new SqlCommand(sql2, connection))
                              {
                                  command2.Parameters.AddWithValue("@Value1", TextBox1.Text);
                                  command2.Parameters.AddWithValue("@Value2", DateTime.Now);
                                  command2.ExecuteNonQuery();
                              }
                              pageBody.Attributes.Add("bgcolor", "#9aff8e");
                              Label1.Text = "Item " + TextBox1.Text + " Recorded!";
                              TextBox1.Text = "";
                          }
                          else
                          {
                              reader.Close();
                              string sql3 = @"SELECT PRODUCT_ID from PRODUCTS where PRODUCT_ID = " + TextBox1.Text + "";
  
                              using(SqlCommand command3 = new SqlCommand(sql3, connection))
                              {
                                  using(SqlDataReader reader2 = command3.ExecuteReader())
                                  {
                                      if (reader2.HasRows)
                                      {
                                          pageBody.Attributes.Add("bgcolor", "#fbff8e");
                                          Label1.Text = "Item " + TextBox1.Text + " Already Shipped!";
                                          TextBox1.Text = "";
                                      }
                                      else
                                      {
                                          pageBody.Attributes.Add("bgcolor", "#ff8e8e");
                                          Label1.Text = "Item " + TextBox1.Text + " Not Found!";
                                          TextBox1.Text = "";
                                      }
                                  }
                              }
                          }
                      }
                  }
              }
              finally
              {
                  if(connection.State != ConnectionState.Closed)
                  {
                      connection.Close();
                  }
              }
          }
      }
  }
  </code></pre>