asp.net - Runtime Exception Incorrect Syntax Near '=' -

<%@ page language="c#" autoeventwireup="true" codefile="postreplyadmin.aspx.cs" inherits="postreplay" masterpagefile="~/adminmaster.master" title="post-reply page"%> <%@ import namespace="system.data" %> <%@ import namespace="system.data.sqlclient" %>  <asp:content contentplaceholderid="contentplaceholder1" runat="server"> <%     string postid = request.querystring["id"];     sqlconnection con = new sqlconnection(configurationmanager.connectionstrings["civilregdb"].connectionstring);     con.open();     string sql = "select * forumthread postid=" + postid;     sqldataadapter da=new sqldataadapter(sql,con);             dataset ds=new dataset();     da.fill(ds);     datarow drow = ds.tables[0].rows[0];     string name = drow["name"].tostring();     string desc = drow["description"].tostring();     datetime dt = convert.todatetime(drow["postdate"].tostring());     string postdate = dt.tostring("dd/mm/yyyy",system.globalization.cultureinfo.invariantculture );     string mailid = drow["email"].tostring();     %> </asp:content> 

i'm getting sqlexception while i'm trying reply post. error: incorrect syntax near '='. i've looked around find other questions similar mine, can't find worth me.

i'm getting error on "da.fill(ds);". can me out on this...:(

your postid string should enclosed single quotes '

string sql = "select * forumthread postid='" + postid +"'"; 

but better if use sqlparameter save sql injection.

like:

string postid = request.querystring["id"]; sqlconnection con = new sqlconnection(configurationmanager.connectionstrings["civilregdb"].connectionstring); con.open(); string sql = "select * forumthread postid=@postid"; //parameter sqlcommand cmd = new sqlcommand(sql, con); cmd.parameters.addwithvalue("postid", postid); sqldataadapter da = new sqldataadapter(cmd); // pass command adapter dataset ds = new dataset(); da.fill(ds); datarow drow = ds.tables[0].rows[0]; string name = drow["name"].tostring(); string desc = drow["description"].tostring(); datetime dt = convert.todatetime(drow["postdate"].tostring()); string postdate = dt.tostring("dd/mm/yyyy", system.globalization.cultureinfo.invariantculture); string mailid = drow["email"].tostring();