Passing value of textbox to a class VS2013 ASPX C#

Question

I have a Gridview.aspx, Gridview.aspx.cs and GetData.cs (class)

In Gridview.aspx I have a textbox named SearchData and a button named SearchBtn

I have this in my Gridview.aspx.cs >>>

protected void SearchBtn_Click(object sender, EventArgs e){
    if (!IsPostBack){
        Search_Grid();
    }
}

void Search_Grid(){ 
    DataGridView.DataSource = obj.Search_Data();
    DataGridView.DataBind();
}

And since it's my first time to use a class, here's what i put in GetData.cs >>>

public DataTable Search_Data(){
    adap = new SqlDataAdapter("select * from MyTable " +
                                      "where MyID = '" + 
                                       value_of_my_SearchData_textbox + 
                                       "'", con);
    dt = new DataTable();
    adap.Fill(dt);
    return dt;
}

ASPX Code GridView.aspx code is long, but here's what under the gridview part:

<table id="TBL_GridView" runat="server" align="center">
    <tr>
        <td  text-align:center">*** TEST ONLY ***</td>
    </tr>
    <tr>
        <td >  
            <asp:Label ID="Label1" runat="server" Text="Procedure name: "></asp:Label> &nbsp;
            <asp:TextBox ID="SearchData" runat="server"></asp:TextBox> &nbsp;
            <asp:Button ID="SearchBtn" runat="server" Text="Search" OnClick="SearchBtn_Click" /> 
        </td>
    </tr>
    <tr >
        <td >
            <asp:GridView ID="DataGridView" runat="server" AutoGenerateColumns="False" ShowFooter="True" 
                CellPadding="4" ForeColor="#333333" GridLines="None" Height="281px" style="margin-top: 0px" Width="1000px" 
                OnRowCancelingEdit="DataGridView_RowCancelingEdit"  
                OnRowEditing="DataGridView_RowEditing" HorizontalAlign="Center" >

                <AlternatingRowStyle BackColor="White" ForeColor="#284775" />

                <Columns>

                    <asp:TemplateField>
                        <HeaderTemplate>Recipe Name</HeaderTemplate>
                        <ItemTemplate><asp:Label ID="recpname" runat="server" Text='<%# Bind("recpname")%>'></asp:Label></ItemTemplate>
                        <EditItemTemplate><asp:TextBox ID="recpname" runat="server"></asp:TextBox></EditItemTemplate>
                        <FooterTemplate><asp:TextBox ID="recpname" runat="server"></asp:TextBox></FooterTemplate>
                    </asp:TemplateField>

                    <asp:TemplateField>
                        <HeaderTemplate>Standard Time</HeaderTemplate>
                        <ItemTemplate><asp:Label ID="stdtime" runat="server" Text='<%# Bind("stdtime")%>'></asp:Label></ItemTemplate>
                        <EditItemTemplate><asp:TextBox ID="stdtime" runat="server"></asp:TextBox></EditItemTemplate>
                        <FooterTemplate><asp:TextBox ID="stdtime" runat="server"></asp:TextBox></FooterTemplate>
                    </asp:TemplateField>

                    <asp:TemplateField>
                        <HeaderTemplate>Operation</HeaderTemplate>
                        <ItemTemplate>
                            <asp:Button ID="BtnEdit" runat="server" Text="Edit" CommandName="Edit" Width="60px" />
                        </ItemTemplate>
                        <EditItemTemplate>
                            <asp:Button ID="BtnUpdate" runat="server" Text="Update" CommandName="Update" Width="60px" />
                            <asp:Button ID="BtnCancle" runat="server" Text="Cancel" CommandName="Cancel" Width="60px" />
                        </EditItemTemplate>
                        <FooterTemplate>
                            <asp:Button ID="BtnInsert" runat="server" Text="Insert"  Width="60px" OnClick="BtnInsert_Click" />
                        </FooterTemplate>
                    </asp:TemplateField>

                </Columns>
            </asp:GridView>
            <br />
            <asp:Literal ID="Literal1" runat="server"></asp:Literal>
        </td>
    </tr>
</table>

How should I pass the value of my textbox to my class?

Answer 1

I see that your text box SearchData is just an ordinary textbox outside of gridview and not in the gridview.

You can simply use:

SearchData.Text

Change the methods to pass SearchData.Text

protected void SearchBtn_Click(object sender, EventArgs e){
    if (!IsPostBack){
        Search_Grid(SearchData.Text);
    }
}

void Search_Grid(string searchValue){ 
    DataGridView.DataSource = obj.Search_Data(searchValue);
    DataGridView.DataBind();
}

Finally use it:

public DataTable Search_Data(string searchValue){
   adap = new SqlDataAdapter("select * from MyTable " +
                                  "where MyID = '" + 
                                   searchValue + 
                                   "'", con);
   dt = new DataTable();
   adap.Fill(dt);
   return dt;
}

However, note this code is prone to SQL Injection attack because you are adding value inline, so an attacker can add ; delete from my table to wipe your data.

You should parameterize your query.

adap = new SqlDataAdapter("select * from MyTable where MyID = @myIdValue", con);