Click here to Skip to main content
15,888,148 members
Home / Discussions / C#
   

C#

 
QuestionDeploy POS.NET files Pin
Jassim Rahma20-Jul-15 2:42
Jassim Rahma20-Jul-15 2:42 
AnswerRe: Deploy POS.NET files Pin
ZurdoDev20-Jul-15 8:47
professionalZurdoDev20-Jul-15 8:47 
QuestionCreating a SELECT Query Based on Textbox Data Pin
John L. DeVito19-Jul-15 4:59
professionalJohn L. DeVito19-Jul-15 4:59 
GeneralRe: Creating a SELECT Query Based on Textbox Data Pin
PIEBALDconsult19-Jul-15 5:06
mvePIEBALDconsult19-Jul-15 5:06 
AnswerRe: Creating a SELECT Query Based on Textbox Data Pin
Wendelius19-Jul-15 5:25
mentorWendelius19-Jul-15 5:25 
AnswerRe: Creating a SELECT Query Based on Textbox Data Pin
Dave Kreskowiak19-Jul-15 6:29
mveDave Kreskowiak19-Jul-15 6:29 
AnswerRe: Creating a SELECT Query Based on Textbox Data Pin
F-ES Sitecore19-Jul-15 22:29
professionalF-ES Sitecore19-Jul-15 22:29 
AnswerRe: Creating a SELECT Query Based on Textbox Data Pin
Richard Deeming20-Jul-15 6:58
mveRichard Deeming20-Jul-15 6:58 
John L. DeVito wrote:
My plan is to just 'get it working' and then I will go back over it and and change to parameterized queries

That's a very bad plan. There's a good chance that you'll miss something, or forget to do it, or run out of time, or lose interest and move on to the next project... Smile | :)

Plus, as others have pointed out, using string concatenation to build your query will introduce new problems that you'll have to fix, which wouldn't be the case if you used properly parameterized queries.

Parameterized queries aren't particularly hard, particularly as you're using ADO.NET and SQL Server:
C#
private void searchButton_Click(object sender, EventArgs e)
{
    // TODO: This should probably be in the configuration file:
    const string ConnectionString = @"Server=MyAzureServer,MyPortNumber;Database=MyDatabase;User ID=me@MyAzureServer;Password=MyPassword;Trusted_Connection=False;Encrypt=True;Connection Timeout=30;";
    
    const string Query = @"SELECT 
    Title, 
    Director, 
    Genre, 
    ReleaseYear, 
    Length, 
    NumberofDisks, 
    Description 
FROM 
    Base 
WHERE 
    (NullIf(@Title, '') Is Null Or Title = @Title) 
AND 
    (NullIf(@Director, '') Is Null Or Director = @Director) 
AND 
    (NullIf(@Genre, '') Is Null Or Genre = @Genre) 
AND 
    (NullIf(@ReleaseYear, '') Is Null Or ReleaseYear = @ReleaseYear) 
AND 
    (NullIf(@Length, '') Is Null Or Length = @Length) 
AND 
    (NullIf(@NumberOfDisks, '') Is Null Or NumberOfDisks = @NumberOfDisks) 
AND
    (NullIf(@Description, '') Is Null Or Description = @Description)
;";

    DataTable dTable = new DataTable();

    using (SqlConnection connection = new SqlConnection(ConnectionString))
    using (SqlCommand command = new SqlCommand(Query, connection))
    {
        command.Parameters.AddWithValue("@Title", titleTextbox.Text);
        command.Parameters.AddWithValue("@Director", directorTextbox.Text);
        command.Parameters.AddWithValue("@Genre", genreCombobox.GetItemText(genreCombobox.SelectedItem));
        command.Parameters.AddWithValue("@ReleaseYear", yearCombobox.GetItemText(yearCombobox.SelectedItem));
        command.Parameters.AddWithValue("@Length", lengthTextbox.Text);
        command.Parameters.AddWithValue("@NumberOfDisks", numberOfDisksTextbox.Text);
        command.Parameters.AddWithValue("@Description", descriptionTextbox.Text);

        connection.Open();
        using (SqlDataReader reader = command.ExecuteReader(CommandBehavior.CloseConnection))
        {
            dTable.Load(reader);
        }
    }

    resultsDataGridView.DataSource = dTable;
}




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


Questionan unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
BillWoodruff19-Jul-15 4:05
professionalBillWoodruff19-Jul-15 4:05 
AnswerRe: an unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
Alan N19-Jul-15 9:44
Alan N19-Jul-15 9:44 
GeneralRe: an unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
BillWoodruff19-Jul-15 11:46
professionalBillWoodruff19-Jul-15 11:46 
GeneralRe: an unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
Member 1113646119-Jul-15 10:01
Member 1113646119-Jul-15 10:01 
GeneralRe: an unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
BillWoodruff19-Jul-15 11:49
professionalBillWoodruff19-Jul-15 11:49 
AnswerRe: an unexpected absence of fail ... using anonymous actions in a WinForm EventHandler Pin
Richard Deeming20-Jul-15 6:43
mveRichard Deeming20-Jul-15 6:43 
QuestionApplication is Crashing Pin
Jassim Rahma19-Jul-15 1:10
Jassim Rahma19-Jul-15 1:10 
AnswerRe: Application is Crashing Pin
OriginalGriff19-Jul-15 1:36
mveOriginalGriff19-Jul-15 1:36 
AnswerRe: Application is Crashing Pin
Dave Kreskowiak19-Jul-15 3:54
mveDave Kreskowiak19-Jul-15 3:54 
QuestionHow to get google place predictions with latitude, longitude and address based on Textbox entry in c# Pin
sr15918-Jul-15 19:05
sr15918-Jul-15 19:05 
AnswerRe: How to get google place predictions with latitude, longitude and address based on Textbox entry in c# Pin
OriginalGriff18-Jul-15 20:17
mveOriginalGriff18-Jul-15 20:17 
QuestionCar tracker Pin
lolinga218-Jul-15 8:58
lolinga218-Jul-15 8:58 
AnswerRe: Car tracker Pin
Dave Kreskowiak18-Jul-15 9:36
mveDave Kreskowiak18-Jul-15 9:36 
GeneralRe: Car tracker Pin
lolinga218-Jul-15 9:42
lolinga218-Jul-15 9:42 
GeneralRe: Car tracker Pin
Mycroft Holmes18-Jul-15 14:35
professionalMycroft Holmes18-Jul-15 14:35 
QuestionError Converting String to Int Pin
Broodje Games18-Jul-15 2:26
Broodje Games18-Jul-15 2:26 
AnswerRe: Error Converting String to Int Pin
OriginalGriff18-Jul-15 2:31
mveOriginalGriff18-Jul-15 2:31 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.