Error when selecting between two dates from vb.net to sql - sql

Question

I have the code below
technician_sqlsource.SelectCommand = "Select analyst as Analyst, sample_description, RFA_number, convert(varchar(10), updated_date, 103)as updated_date, customer, po_number, total_charged from New_Analysis_Data where analyst = '" & FullName & "' and updated_date > '" & CDate(startdate.Text) & "'" & " and updated_date < '" & CDate(enddate.Text) & "'"
This basically passed through the sql command to the sql server and retrieves data between 2 dates. These dates come from 2 text boxes (start and end date). When I run this I get the error - The conversion of a varchar data type to a datetime data type resulted in an out-of-range value.
If I remove & "'" & " and updated_date < '" & CDate(enddate.Text) & "'" then it will work, seems to be an issue with the enddate.

Answer 1

Use query parameters!
technician_sqlsource.SelectCommand = _
"SELECT analyst as Analyst, sample_description, RFA_number, " & _
" convert(varchar(10), updated_date, 103)as updated_date, " & _
" customer, po_number, total_charged " & _
" FROM New_Analysis_Data " & _
" WHERE analyst = #FullName " & _
" AND updated_date >= #StartDate AND updated_date < #EndDate"
With technician_sqlsource.SelectCommand.Parameters
.Add("#FullName", SqlDbType.VarChar,50).Value = FullName
.Add("#StartDate", SqlDbType.DateTime).Value = startdate.Text
.Add("#EndDate", SqlDbType.DateTime).Value = enddate.Text
End With
This also may or may not fix your problem with the end date. Even if it doesn't fix the problem, you should get a clearer error message... but most likely, you're not entering a valid date format in that textbox. Have you considered using a DatePicker control?

Answer 2

1st off you should use SqlParameters!!!
It is much safer and you will also get rid of the date conversion issue.
SqlCommand cmd=new SqlCommand();
cmd.CommandText = #"
Select analyst as Analyst,
sample_description,
RFA_number,
convert(varchar(10), updated_date, 103) as updated_date,
customer,
po_number,
total_charged
from New_Analysis_Data
where analyst = #analyst
and updated_date between #startdate and #enddate";
technician_sqlsource.SelectCommand = cmd;
technician_sqlsource.SelectCommand.Parameters.Add(new SqlParameter("#analyst", FullName));
technician_sqlsource.SelectCommand.Parameters.Add(new SqlParameter("#startdate",CDate(startdate.Text)));
technician_sqlsource.SelectCommand.Parameters.Add(new SqlParameter("#enddate", CDate(enddate.Text)));

Answer 3

If you want still in your old (unsafe) style .. you can try this ..
technician_sqlsource.SelectCommand = "Select analyst as Analyst, sample_description, RFA_number, convert(varchar(10), updated_date, 103)as updated_date, customer, po_number, total_charged from New_Analysis_Data where analyst = '" & FullName & "' and updated_date > #" & startdate.Text & "# and updated_date < #" & enddate.Text & "#"
But later you must use query parameters! .. to prevent SQL Injection !

Answer 4

try this:
technician_sqlsource.SelectCommand = "Select analyst as Analyst, sample_description, RFA_number, convert(varchar(10), updated_date, 103)as updated_date, customer, po_number, total_charged from New_Analysis_Data where analyst = '" & FullName & "' and updated_date > '" & CDate(startdate.Text) & "' and updated_date < '" & CDate(enddate.Text) & "'"