ASP .NET Forms and Submit - asp.net

Question

I am new to ASP .Net Web Forms. Tried creating a Web Page going through Youtube Tutorials and now I'm stuck on this step where I have created a form with inputs and select using Bootstrap. Here is what my Frontend looks like which is in Default.aspx ---->
<%# Page Title="Home Page" Language="C#" MasterPageFile="~/Site.Master" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="WebApplication2._Default" %>
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server">
<div class="jumbotron">
<center class="form-group-lg">
<form method="post" action="btnShow_Click">
<label>Token Number</label>
<input type="text" name="txtCommand" id="txtCommand" class="text-center form-control" value="" runat="server" />
<div class="row form-group">
<div class="col-md-4">
<label>Room Number</label>
<select class="form-control" name="CounterID" id="CounterID" runat="server">
<option value="0">Select Room Number</option>
<option value="1">Room Number 01</option>
<option value="2">Room Number 02</option>
<option value="3">Room Number 03</option>
<option value="4">Room Number 04</option>
<option value="5">Room Number 05</option>
<option value="6">Room Number 06</option>
<option value="7">Room Number 07</option>
<option value="8">Room Number 08</option>
<option value="9">Room Number 09</option>
<option value="10">Room Number 10</option>
</select>
</div>
<div class="col-md-4">
<label>Department</label>
<select class="form-control" id="CounterName" name="CounterName" runat="server">
</select>
</div>
<div class="col-md-4">
<label>Terminal</label>
<input type="text" class="form-control" name="TerminalID" id="TerminalID" runat="server" value="000" />
</div>
</div>
<div class="row">
<div class="col-md-6">
<p>Waiting Patients: <span id="label2">100</span></p>
<!-- <input type="text" readonly name="" id="label2" class="form-control" runat="server" value=""/> -->
</div>
<div class="col-md-6">
<p>Total Patients: <span id="label1">100</span></p>
<!-- <input type="text" readonly name="label1" id="label1" class="form-control" runat="server" value=""/> -->
</div>
</div>
<div class="form-group" style="margin-top:15px;">
<asp:Button ID="btnShow" type="submit" runat="server" Text="Next" Width="56px"/>
</div>
</form>
</center>
</div>
</asp:Content>
and my Default.aspx.cs looks like --->>
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;
using System.Configuration;
namespace WebApplication2
{
public partial class _Default : Page
{
protected void Page_Load(object sender, EventArgs e)
{
string conn = ConfigurationManager.ConnectionStrings["GIMS_HIMS"].ConnectionString;
SqlConnection sqlconn = new SqlConnection(conn);
string depart = "select DeptCode, DepartmentName from Que_Master_Department where Active = 1";
SqlDataAdapter sda = new SqlDataAdapter(depart, sqlconn);
sqlconn.Open();
DataTable dt = new DataTable();
sda.Fill(dt);
CounterName.DataSource = dt;
CounterName.DataTextField = "DepartmentName";
CounterName.DataValueField = "DepartmentName";
CounterName.DataBind();
sqlconn.Close();
btnShow.Click += btnShow_Click;
}
//Recall Button Commands Start Here
private void Recall_Click(object sender, EventArgs e)
{
CalcPatientRemain();
string conn = ConfigurationManager.ConnectionStrings["GIMS_HIMS"].ConnectionString;
SqlConnection sqlconn = new SqlConnection(conn);
string query = " DELETE FROM Que_Delegation WHERE Token = '" + txtCommand.Value + "'";
SqlCommand scom = new SqlCommand(query, sqlconn);
sqlconn.Open();
scom.ExecuteNonQuery();
query = " INSERT INTO Que_Delegation (Token, TerminalID, CounterID, CounterName, Dispatch) VALUES ('" + txtCommand.Value + "','" + TerminalID + "','" + CounterID + "','" + CounterName + "','False')";
SqlCommand scom1 = new SqlCommand(query, sqlconn);
scom1.ExecuteNonQuery();
sqlconn.Close();
}
//Recall Button Commands Ended
//Next Button Commands Starts
protected void Next_Click(object Sender, EventArgs e)
{
GetToken();
CalcPatientRemain();
MainScreenDisplay();
}
public void GetToken()
{
try
{
string conn = ConfigurationManager.ConnectionStrings["GIMS_HIMS"].ConnectionString;
SqlConnection sqlconn = new SqlConnection(conn);
String userqry = "SELECT TOP(1) Token, ID FROM Que_Management2 Where Department = '" + CounterName + "' AND Flag = 'False' ORDER BY ID ASC";
sqlconn.Open();
SqlCommand cmd = new SqlCommand(userqry, sqlconn);
SqlDataReader dr = cmd.ExecuteReader();
if (dr.HasRows == true)
{
while (dr.Read())
{
txtCommand.Value = dr[0].ToString();
}
}
else
{
txtCommand.Value = string.Empty;
}
dr.Close();
string query = "Update Que_Management2 SET Flag = 'True' WHERE Token = '" + txtCommand.Value + "'";
SqlCommand scom2 = new SqlCommand(query, sqlconn);
scom2.ExecuteNonQuery();
if (txtCommand.Value != "")
{
query = " DELETE FROM Que_Delegation";
SqlCommand scom3 = new SqlCommand(query, sqlconn);
scom3.ExecuteNonQuery();
query = " INSERT INTO Que_Delegation (Token, TerminalID, CounterID, CounterName, Dispatch) VALUES ('" + txtCommand.Value + "','" + TerminalID + "','" + CounterID + "','" + CounterName + "','False')";
SqlCommand scom4 = new SqlCommand(query, sqlconn);
scom4.ExecuteNonQuery();
}
sqlconn.Close();
}
catch (Exception ex)
{
string abc = ex.Message;
}
}
public void CalcPatientRemain()
{
try
{
string conn = ConfigurationManager.ConnectionStrings["GIMS_HIMS"].ConnectionString;
SqlConnection sqlconn = new SqlConnection(conn);
sqlconn.Open();
DateTime Date1 = DateTime.Today;
DateTime Date2 = DateTime.Today.AddDays(1);
SqlDataReader dr;
SqlCommand cmd;
cmd = new SqlCommand("usp_GetPatientRemain", sqlconn);
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add("#Date1", SqlDbType.DateTime).Value = Date1;
cmd.Parameters.Add("#Date2", SqlDbType.DateTime).Value = Date2;
cmd.Parameters.Add("#Department", SqlDbType.NVarChar).Value = CounterName;
dr = cmd.ExecuteReader();
if (dr.HasRows == true)
{
while (dr.Read())
{
label2.Value = (dr[0].ToString());
}
}
dr.Close();
cmd = new SqlCommand("usp_GetPatientTotal", sqlconn);
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add("#Date1", SqlDbType.DateTime).Value = Date1;
cmd.Parameters.Add("#Date2", SqlDbType.DateTime).Value = Date2;
cmd.Parameters.Add("#Department", SqlDbType.NVarChar).Value = CounterName;
dr = cmd.ExecuteReader();
if (dr.HasRows == true)
{
while (dr.Read())
{
label1.Value = (dr[0].ToString());
}
}
dr.Close();
sqlconn.Close();
}
catch (Exception ex)
{
string abc = ex.Message;
}
}
public void MainScreenDisplay()
{
string conn = ConfigurationManager.ConnectionStrings["GIMS_HIMS"].ConnectionString;
SqlConnection sqlconn = new SqlConnection(conn);
sqlconn.Open();
string Date = DateTime.Now.ToString("MM/dd/yyyy");
string query = "";
if (txtCommand.Value == "" || txtCommand.Value == null)
{
txtCommand.Value = "----";
}
if (CounterID.Value == "1")
{
query = "Update Que_MainScreenDelegate2 SET T1 = '" + txtCommand.Value + "', C1 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom5 = new SqlCommand(query, sqlconn);
scom5.ExecuteNonQuery();
}
else if (CounterID.Value == "2")
{
query = "Update Que_MainScreenDelegate2 SET T2 = '" + txtCommand.Value + "', C2 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom6 = new SqlCommand(query, sqlconn);
scom6.ExecuteNonQuery();
}
else if (CounterID.Value == "3")
{
query = "Update Que_MainScreenDelegate2 SET T3 = '" + txtCommand.Value + "', C3 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom7 = new SqlCommand(query, sqlconn);
scom7.ExecuteNonQuery();
}
else if (CounterID.Value == "4")
{
query = "Update Que_MainScreenDelegate2 SET T4 = '" + txtCommand.Value + "', C4 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom8 = new SqlCommand(query, sqlconn);
scom8.ExecuteNonQuery();
}
else if (CounterID.Value == "5")
{
query = "Update Que_MainScreenDelegate2 SET T5 = '" + txtCommand.Value + "', C5 = '" + CounterID + "' , CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom9 = new SqlCommand(query, sqlconn);
scom9.ExecuteNonQuery();
}
else if (CounterID.Value == "6")
{
query = "Update Que_MainScreenDelegate2 SET T6 = '" + txtCommand.Value + "', C6 = '" + CounterID + "' , CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom10 = new SqlCommand(query, sqlconn);
scom10.ExecuteNonQuery();
}
else if (CounterID.Value == "7")
{
query = "Update Que_MainScreenDelegate2 SET T7 = '" + txtCommand.Value + "', C7 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom11 = new SqlCommand(query, sqlconn);
scom11.ExecuteNonQuery();
}
else if (CounterID.Value == "8")
{
query = "Update Que_MainScreenDelegate2 SET T8 = '" + txtCommand.Value + "', C8 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom12 = new SqlCommand(query, sqlconn);
scom12.ExecuteNonQuery();
}
else if (CounterID.Value == "9")
{
query = "Update Que_MainScreenDelegate2 SET T9 = '" + txtCommand.Value + "', C9 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom13 = new SqlCommand(query, sqlconn);
scom13.ExecuteNonQuery();
}
else if (CounterID.Value == "10")
{
query = "Update Que_MainScreenDelegate2 SET T10 = '" + txtCommand.Value + "', C10 = '" + CounterID + "', CMain = '" + CounterID + "', TMain = '" + txtCommand.Value + "', Sound = 'YES' WHERE Date = '" + Date + "'";
SqlCommand scom14 = new SqlCommand(query, sqlconn);
scom14.ExecuteNonQuery();
}
}
//Next Button Commands Ended
protected void btnShow_Click(object Sender, EventArgs e)
{
// Page.ClientScript.RegisterStartupScript(
//Page.GetType(),
//"MessageBox",
//"<script language='javascript'>alert('Hello');</script>"
//);
GetToken();
CalcPatientRemain();
MainScreenDisplay();
}
}
}
The problem I'm facing is its doing nothing. No changes are visible and the database also shows no updates. The button works when I trigger OnClick event on it as show in the commented function where I was showing a message on button click but same when I try my functions its not working. Can someone please help what I'm doing wrong.

Answer 1

Dump this tutorial immediately. It teaches you an outdated framework (WebForms is not maintained anymore and won't run on .NET 5), and worse, it has giant SQL injection vulnerabilities (despite using parameterized queries - sometimes). Seriously, tutorials like this should be pulled.
If you want to create a .NET web application in 2021, use ASP.NET Core MVC or Razor Pages.
As for your error, you don't bind the Recall_Click handler to any button.