NPGSQL seems to have a rather large bug?

Question

this is a weird one, when I run the following code all rows are returned from the db. Imagaine what would happen if this was an update or delete.

    Dim cmd As New NpgsqlCommand

    cmd.Connection = conn
    cmd.CommandText = "select * FROM ac_profiles WHERE profileid = @profileId"
    cmd.Parameters.Add("@profile", 58)
    Dim dt As DataTable = DataAccess2.DataAccess.sqlQueryDb(cmd)

    DataGridView1.DataSource = dt

My question is why is this happening?

Answer 1

I'm no pg-sql expert, but I strongly suspect it's because you're adding a different parameter from the one you're using in the SQL statement. I think you're also using the wrong syntax to refer to a parameter. See the user manual for more information. Try this:

cmd.Connection = conn
cmd.CommandText = "select * FROM ac_profiles WHERE profileid = :profileid"
cmd.Parameters.Add("profileid", 58)
Dim dt As DataTable = DataAccess2.DataAccess.sqlQueryDb(cmd)