help with ORA-00936: missing expression 

--------------------------------------------------------------------------------

can some one help me with following error message -looks like my sql is not right.
pl. help


-this is my aspx code
<asp:ObjectDataSource ID="OdsCty" runat="server" 
                  SelectMethod="GetALLCity" 
                 TypeName="GetALLCatagory">
                 <SelectParameters>
                     <asp:Parameter Name="MyState" DefaultValue="" />
                     <asp:Parameter  Name="mytype" 
                         DefaultValue="G" />
                     <asp:Parameter  Name="FromYear" DefaultValue="" />
                     <asp:Parameter  Name="ToYear" DefaultValue="" />
                 </SelectParameters>
             </asp:ObjectDataSource>
           CITY: 
            <asp:DropDownList ID="ddlCity" runat="server" DataSourceID="OdsCty" 
            DataTextField="CITY" DataValueField="STATE_COUNTRY_CODE" 
            OnSelectedIndexChanged="ddlCity_SelectedIndexChanged" >            
            </asp:DropDownList>
and this -"GetALLCatagory.cs"




public static DataSet GetALLCity(string FromYear, string ToYear, string mytype, string MyState)
{
OracleCommand cmd = new OracleCommand();
string sel = string.Empty;

if (string.IsNullOrEmpty(FromYear) && string.IsNullOrEmpty(ToYear) && string.IsNullOrEmpty(mytype) && string.IsNullOrEmpty(MyState))
{
sel = "SELECT DISTINCT STATE_COUNTRY_CODE, CITY FROM STATE_CITY_DISTCD_VW ";
}
else
{
sel = "SELECT DISTINCT STATE_COUNTRY_CODE, CITY FROM STATE_CITY_DISTCD_VW WHERE SOURCE_YEAR >= " + FromYear + " and SOURCE_YEAR < " + ToYear + " and Record_Type = '" + mytype + "' and STATE_COUNTRY_CODE = '" + MyState + "' ";
cmd.Parameters.AddWithValue("@FromYear", FromYear);
cmd.Parameters.AddWithValue("@ToYear", ToYear);
cmd.Parameters.AddWithValue("@RecordType", mytype);
cmd.Parameters.AddWithValue("@MyState", MyState);
}

OracleConnection con = new OracleConnection(ConfigurationManager.ConnectionStrings["ConStr"].ConnectionString);

cmd.CommandType = CommandType.Text;
cmd.CommandText = sel;
con.Open();

OracleDataAdapter da = new OracleDataAdapter(sel, con);
DataSet dscity = new DataSet();
da.Fill(dscity, "STATE_CITY_DISTCD_VW");
return dscity;
con.Close();
con.Dispose();


}


Server Error in '/hits' Application.
--------------------------------------------------------------------------------

ORA-00936: missing expression

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.Data.OracleClient.OracleException: ORA-00936: missing expression


Source Error: 


Line 104: OracleDataAdapter da = new OracleDataAdapter(sel, con);
Line 105: DataSet dscity = new DataSet();
Line 106: da.Fill(dscity, "STATE_CITY_DISTCD_VW");
Line 107: return dscity;
Line 108: con.Close();


Source File: c:\hits\App_code\GetALLCatagory.cs Line: 106 

Stack Trace: 


[OracleException (0x80131938): ORA-00936: missing expression
]
System.Data.OracleClient.OracleConnection.CheckError(OciErrorHandle errorHandle, Int32 rc) +304889
System.Data.OracleClient.OracleCommand.Execute(OciStatementHandle statementHandle, CommandBehavior behavior, Boolean needRowid, OciRowidDescriptor& rowidDescriptor, ArrayList& resultParameterOrdinals) +990
System.Data.OracleClient.OracleCommand.Execute(OciStatementHandle statementHandle, CommandBehavior behavior, ArrayList& resultParameterOrdinals) +25
System.Data.OracleClient.OracleCommand.ExecuteReader(CommandBehavior behavior) +142
System.Data.OracleClient.OracleCommand.ExecuteDbDataReader(CommandBehavior behavior) +4
System.Data.Common.DbCommand.System.Data.IDbCommand.ExecuteReader(CommandBehavior behavior) +10
System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +130
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +287
System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, String srcTable) +92
GetALLCatagory.GetALLCity(String FromYear, String ToYear, String mytype, String MyState) in c:\hits\App_code\GetALLCatagory.cs:106

[TargetInvocationException: Exception has been thrown by the target of an invocation.]
System.RuntimeMethodHandle._InvokeMethodFast(Object target, Object[] arguments, SignatureStruct& sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner) +0
System.RuntimeMethodHandle.InvokeMethodFast(Object target, Object[] arguments, Signature sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner) +71
System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture, Boolean skipVisibilityChecks) +261
System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) +29
System.Web.UI.WebControls.ObjectDataSourceView.InvokeMethod(ObjectDataSourceMethod method, Boolean disposeInstance, Object& instance) +488
System.Web.UI.WebControls.ObjectDataSourceView.ExecuteSelect(DataSourceSelectArguments arguments) +1247
System.Web.UI.WebControls.ListControl.OnDataBinding(EventArgs e) +95
System.Web.UI.WebControls.ListControl.PerformSelect() +34
System.Web.UI.WebControls.BaseDataBoundControl.DataBind() +73
System.Web.UI.WebControls.BaseDataBoundControl.EnsureDataBound() +82
System.Web.UI.WebControls.BaseDataBoundControl.OnPreRender(EventArgs e) +22
System.Web.UI.WebControls.ListControl.OnPreRender(EventArgs e) +18
System.Web.UI.Control.PreRenderRecursiveInternal() +80
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Control.PreRenderRecursiveInternal() +171
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +842




--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:2.0.50727.3082; ASP.NET Version:2.0.50727.3082 

 To this line you can try this instead
sel = "SELECT DISTINCT STATE_COUNTRY_CODE, CITY FROM STATE_CITY_DISTCD_VW WHERE SOURCE_YEAR >= to_number('" + FromYear + "') and SOURCE_YEAR < to_number('" + ToYear + "') and Record_Type = '" + mytype + "' and STATE_COUNTRY_CODE = '" + MyState + "' ";

 I'm not clear on this part..

sel = "SELECT DISTINCT STATE_COUNTRY_CODE, CITY FROM STATE_CITY_DISTCD_VW WHERE SOURCE_YEAR >= " + FromYear + " and SOURCE_YEAR < " + ToYear + " and Record_Type = '" + mytype + "' and STATE_COUNTRY_CODE = '" + MyState + "' ";
cmd.Parameters.AddWithValue("@FromYear", FromYear);
cmd.Parameters.AddWithValue("@ToYear", ToYear);
cmd.Parameters.AddWithValue("@RecordType", mytype);
cmd.Parameters.AddWithValue("@MyState", MyState);

You're using a hard coded statement with literals, but then proceed to bind parameters where none exist in the statement.

If you're using parameters, you'd put placeholders in the statement, not values..  for example:
  select foo from bar where col1 = :val1, col2 >= :val2, ..   etc,
then bind parameters
  cmd.Parameters.AddWithValue("val1", FromYear);
  cmd.Parameters.AddWithValue("val2", ToYear);
... etc ...

As is though, your app wouldnt use the parameters, so to troubleshoot why you get that error with what your app is actually doing, I'd recommend capturing the command text of the the sql statement you'er generating using the string concatenation, which should give you a full sql statement you can also run in sqlplus.  Test it there and you'll probably see the same behavior.   

 Of course, the better solution though, is to make your sql statement actually use bind variables instead of literals.

Hope it helps,
Greg