Help to update the DropDownList

[HiSpeed]

I have a page with two DropDownList. One of them populating the list in Page_Load () with information retrieved from a database.

What I wish is that I select an item in DropDownList min can use what's in it in an SQL query for populating the second box.

protected void Page_Load (object sender, EventArgs e) 
{
dbConn = tcObj.returnConnection (); 
try 
{
dbConn.Open (); 
}
catch (Exception connectionException) () 
populateClientDropdown (); 
}

private void populateClientDropdown () 
{
clientDownList.Items.Clear (); 
executeReader ( "SELECT Company FROM Client"); 
dropDownElements.Clear (); 

while (dbReader.Read ()) 
{
dropDownElements.Add (dbReader [ "Company"]. ToString ()); 
}

dbReader.Close (); 

for (int i = 0; i <dropDownElements.Count; i + +) 
{
Listitem lstItem = new Listitem (Drop Down Elements [i]. ToString ()); 
clientDownList.Items.Add (lstItem); 
}
}

private void populateSubClientDropdown () 
{
subClientDropDownList.Items.Clear (); 
executeReader ( "SELECT Client_Location.Sub_Company_Name FROM Client_Location, Client WHERE Client_Location.Client_ID = Client.ID_Client AND Client.Company = '" + clientDownList.Text +"'"); 
dropDownElements.Clear (); 

while (dbReader.Read ()) 
{
dropDownElements.Add (dbReader [ "Sub_Company_Name"]. ToString ()); 
}

for (int i = 0; i <dropDownElements.Count; i + +) 
{ 
Listitem lstItem = new Listitem (Drop Down Elements [i]. ToString ()); 
subClientDropDownList.Items.Add (lstItem); 
}
}

protected void clientDownList_SelectedIndexChanged (object sender, EventArgs e) 
{
populateSubClientDropdown (); 
}

<asp: DropDownList ID = "client Down List" runat = "server" Auto Post Back = "True" 
onselectedindexchanged = "clientDownList_SelectedIndexChanged"> 
</asp: DropDownList>

It's happening now is that the Page_Load () is run every time I change the item in the DropDownList min, resulting in the error value is used when using clientDownList.Text in my query.

[Ashok.M]

Think you may well start by adding an "if (dropDownElements.Count == 0)" around the call to populateClientDropdown - otherwise you'll ask to do it every post back - the Page_Load is called each post back.

Otherwise: Make SQL injection ..
Parameter your always always always always all sql parameters:

SqlCommand cmd = conn.CreateCommand (); 
cmd.CommandText = "SELECT Client_Location.Sub_Company_Name FROM Client_Location, Client WHERE Client_Location.Client_ID = Client.ID_Client AND Client.Company = @ Company"; 
cmd.Parameters.AddWithValue ( "@ Company", clientDownList.Text);

[HiSpeed]

This solved the problem:

private void populateClientDropdown () 
{
if (clientDownList.Text == "") 
{
clientDownList.Items.Clear (); 
executeReader (getClientString); 
dropDownElements.Clear (); 

while (dbReader.Read ()) 
{
dropDownElements.Add (dbReader [ "Company"]. ToString ()); 
}

dbReader.Close (); 

for (int i = 0; i <dropDownElements.Count; i++) 
{
Listitem lstItem = new Listitem (Drop Down Elements [i]. ToString ()); 
clientDownList.Items.Add (lstItem); 
}
}
}

I am 110% sure that the users of the system can not use SQL. When I programmed my webpage I used PHP's built-in feature to avoid this problem:

$name_bad = mysql_real_escape_string($name_bad);