Using a repeater to display search results and then redirecting to another form

tlox 0 2K Views

Hello everyone. i have a student database, from which i search a student by entering the student ID at the web interface.Im using a repeater to display search results. Within this repeater i have a link button that should redirect to a page that will display full information about the student.

My problem is that im failing to display the full details of the students.Can someone help or at least suggest a better way of doing this because i doubt if the repeater is the best solution.

Thanks!

part of the .aspx code

<asp:SqlDataSource ID="SqlDataSource2" runat="server" 
    ConnectionString="<%$ ConnectionStrings:ConnectionString %>" 
    SelectCommand="SELECT Stud_ID, Stud_Name, FileNumber FROM ActiveFiles WHERE (Stud_ID LIKE Stud_ID) OR (Stud_Name LIKE Stud_Name) ORDER BY FileNumber">
</asp:SqlDataSource>

<asp:Repeater ID="Repeater1" runat="server" onitemcommand="Repeater1_ItemCommand">
<ItemTemplate>
    <hr />
        <%# DataBinder.Eval(Container.DataItem, "Stud_ID") %>
    <tb>
      <%# DataBinder.Eval(Container.DataItem, "Stud_Name") %>
    <tb> 
     <asp:LinkButton ID="LinkButton1" CommandName="FileNo" OnClick="LinkButton1_Click"
     Text=<%# DataBinder.Eval(Container.DataItem, "FileNumber") %> runat="server"/>       
    </tb>
   <hr />
</ItemTemplate>
...
</asp:Repeater>


part of the .cs code


protected void SearchButton_Click(object sender, EventArgs e)
{
        string ID_OR_name = TextBox1.Text;

        if (TextBox1.Text != string.Empty)
        {
            SqlConnection conn = new SqlConnection(connectionString);
            conn.Open();

            SqlCommand selectStatement = new SqlCommand("SELECT * FROM ActiveFiles WHERE (Stud_ID               LIKE '%  " + ID_OR_name + "%') OR (Stud_Name LIKE '%" + ID_OR_name + "%') ORDER BY                   FileNumber", conn);
                        
            SqlDataReader datTable = selectStatement.ExecuteReader();
            Repeater1.DataSource = datTable;
            Repeater1.DataBind();

            conn.Close();

            GridView2.DataBind();
            GridView2.Visible = true;
            Response.Write("Search query produced this results");
        }
        else
            Response.Write("Plis enter ID or name to search");
}
 
protected void Repeater1_ItemCommand(object source, RepeaterCommandEventArgs e)
{     
        if (e.CommandName == "FileNo")
        {           
            Response.Write("good");
            //redirect to the page that displays the searched student's detail
            //this is where im stuck
        }
}

Dani AI

Generated

Good summary and a few practical fixes you can apply right away. was right to warn about hard-coded SQL and s suggestion to send an identifier from the repeater is the usual pattern. The reliable approach is: send a single primary key (Stud_ID or FileNumber) from the repeater (either as a NavigateUrl or a CommandArgument), URL-encode it, and let the details page query the database for the full record using a parameterized SELECT. Do not shove both ID and name into one parameter (that is why you saw "id,name" appear in the first textbox) and avoid putting sensitive PII directly in the query string. (owasp.org)

Use parameterized ADO.NET commands and using-blocks when populating the repeater. Example pattern (safe, minimal):

// server-side search (use parameters, not string concat)
var term = "%" + TextBox1.Text.Trim() + "%";
using (var conn = new SqlConnection(connectionString))
using (var cmd = new SqlCommand(
  "SELECT Stud_ID, Stud_Name, FileNumber FROM ActiveFiles WHERE Stud_ID LIKE @t OR Stud_Name LIKE @t ORDER BY FileNumber", conn))
{
  cmd.Parameters.Add("@t", SqlDbType.NVarChar, 200).Value = term;
  conn.Open();
  Repeater1.DataSource = cmd.ExecuteReader();
  Repeater1.DataBind();
}

For the repeater item you can use a simple hyperlink so the browser does the redirect (no ItemCommand required):

<asp:HyperLink runat="server"
  NavigateUrl='<%# "Details.aspx?stud=" + Eval("Stud_ID") %>'
  Text='<%# Eval("FileNumber") %>' />

When the details page loads, read and validate the stud query value, then SELECT that single record with a parameterized query and populate the two textboxes. Using this pattern keeps markup clean, prevents the concatenation bug, and avoids SQL injection; see ADO.NET parameter guidance. (learn.microsoft.com)

If you prefer server-side navigation, Response.Redirect is fine (use the overload that avoids ThreadAbortException or call CompleteRequest afterwards), and Server.Transfer is an option when you want to avoid a round‑trip — but it has different semantics (URL unchanged, same-request context). If you need built-in DataKey support and selection, consider switching to GridView/DataKeyNames instead of a Repeater. (learn.microsoft.com)

Troubleshooting notes: make sure data-binding expressions in attributes are quoted (e.g. Text='<%# Eval("FileNumber") %>'), URL-encode query values, and re-query details by key rather than passing multiple fields in one parameter.

Member Avatar for kvprajapati
kvprajapati 1,826 Posting Genius

Suggestions:

1. No need to use SqlDataSource. Have a look at SearchButton's click. You are populating repeater manually.

2. Never use hard-coded sql strings especially with select statement.

3. You may use CommandArgument property to send button or record specific info to the ItemCommand handler.

Edited by kvprajapati because: typo.
Member Avatar for kouroshnik
kouroshnik 0 Light Poster

page.aspx:

<asp:LinkButton 
     ID="btnPage" 
     runat="server" 
     CommandName="FileNo" 
     CommandArgument='<%# DataBinder.Eval(Container.DataItem, "FileNumber") %>' 
     Text='<%#DataBinder.Eval(Container.DataItem, "FileNumber") %>' >
 </asp:LinkButton>

page.aspx.cs:

protected void Repeater1_ItemCommand(object source, RepeaterCommandEventArgs e)
  {             
    if (e.CommandName == "FileNo")        
     { 
        string ID = e.CommandArgument.toString();                   
        Response.Redirect("page.aspx?id="+id);
     }
  }
Edited by kouroshnik because: n/a
Member Avatar for tlox
tlox 0 Newbie Poster

Thank you guys. Your suggestions helped me out. I have two text boxes in a page where the student details will be displayed. textboxID to display student ID, and textboxName to display student name. But upon clicking the linkbutton, the student ID and name are all displayed in the first textbox.How can i "redirect" these two to different textboxes which are in the same page? I know very little about state management options in asp.net, but im just starting to explore them.
Thanks.

page1.aspx

<asp:LinkButton ID="LinkButton2" runat="server" 
CommandName="StudentID"  
CommandArgument='<%# DataBinder.Eval(Container.DataItem, "studID") + "," +                                       DataBinder.Eval(Container.DataItem, "studName") %>' Text='<%#DataBinder.Eval(Container.DataItem, "studID") + "," + DataBinder.Eval(Container.DataItem, "studName") %>' > 
</asp:LinkButton>

protected void Repeater1_OnItemCommand(object source, RepeaterCommandEventArgs e)
{  
      
        if(e.CommandName == "StudentID")
        {            
            string studentid = e.CommandArgument.ToString();
            //string studentname = e.CommandArgument.ToString();
            Response.Redirect("Page2.aspx?id=" + studentid);
         /*Response.Redirect("Page2.aspx?id={0}&name={1}&file={2}" + studentid + studentname);<---tried this*/
        }

}

page2.aspx

<asp:Label ID="Label1" runat="server" Text="Search Results are as thus:"></asp:Label>
        <br />
        <br />
        <asp:Label ID="Label2" runat="server" Text="Student ID"></asp:Label>
        <asp:TextBox ID="TextBox1" runat="server" ontextchanged="TextBox1_TextChanged"></asp:TextBox>
        <br />
        <br />
        <asp:Label ID="Label3" runat="server" Text="Student Name"></asp:Label>
        <asp:TextBox ID="TextBox2" runat="server" ontextchanged="TextBox2_TextChanged"></asp:TextBox>

public partial class SearchResults : System.Web.UI.Page
{
    
    protected void Page_Load(object sender, EventArgs e)
    {    
        if ((Request.QueryString["id"] != null) || (Request.QueryString["name"] != null))
        {
                       
            TextBox1.Text = Request.QueryString["id"];
            TextBox2.Text = Request.QueryString["name"];
            ...
        }
        
        else
            Response.Write("xxxxx");
    }
}
Member Avatar for asemoonabi
asemoonabi 0 Newbie Poster

Response.Redirect("Page2.aspx?id={0}&name={1}&file={2}" + studentid + studentname);<---tried this

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview