How do create a query with where statement with two conditions?

Question

4.00/5 (1 vote)

See more:

Is there any possible way to create query using where statement with two conditions.

SQL

    string connectionString = "Data Source=PD-JANAKAN;Initial Catalog=Enquiry;User ID=Madushan;Password=P@19861030";
    DataTable dt = new DataTable();
    SqlConnection connection = new SqlConnection(connectionString);
    SqlDataReader myReader = null;
    SqlCommand command = new SqlCommand("SELECT * FROM Enquiry where Cust_Name='" + myselection + "' or Cust_ID='" + vid + "'", connection);
    connection.Open();
    //command.Parameters.AddWithValue("@Cust_Name", myselection);
    myReader = command.ExecuteReader();


    while (myReader.Read())
    {
        Cus_Contact.Text = (myReader["Cust_Cntact"].ToString());
        DateTime Submit = (DateTime)myReader["Submit_Date"];
        DateTime Required = (DateTime)myReader["Req_Date"];
        More_Info.Text = (myReader["More_Details"].ToString());
        Stat_Sec.Text = (myReader["Sec_Status"].ToString());
    }
    connection.Close();
}

Posted 30-Jan-15 0:30am

Hemas Ilearn

Updated 30-Jan-15 0:34am

/\jmot

v2

Add a Solution

Comments

Sinisa Hajnal 30-Jan-15 7:29am

What do you mean? You have two conditions in the query above.

Please consider moving that sql into stored procedure or at least use String.Format for readability:
String.Format("SELECT * FROM Enquiry where Cust_Name='{0}' or Cust_ID='{1}'", myselection, vid) - do you see two conditions now?

Richard Deeming 30-Jan-15 7:53am

NEVER use string concatenation or String.Format to build a SQL query. ALWAYS use a parameterized query.

Sinisa Hajnal 30-Jan-15 8:21am

Totally agree...that's why I suggested stored procedure :) But IF he concatenates, at least he can make it readable.

Dominic Abraham 30-Jan-15 7:31am

Can you make your question little more clear ??

ZurdoDev 30-Jan-15 7:46am

Yes, 2 conditions is very easy. In fact you are already doing it, so what is your question?

Richard Deeming 30-Jan-15 7:52am

Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Sinisa Hajnal 30-Jan-15 8:24am

@Hemas Ilearn, consider if I put into the field myselection the following:
"'; GO; DROP TABLE Enquiry; --" (without quotes). What would your application do?

NEVER TRUST USER INPUT! (as R. Deeming said, don't concatenate strings directly)

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Thomas Nielsen - getCore · Answer 1 · 2015-01-30T11:01:00

Well following the advice of the commentators, let's move it into a store procedure

You wrote:

"SELECT * FROM Enquiry where Cust_Name='" + myselection + "' or Cust_ID='" + vid + "'"

Change to:
On mssql execute command:
(datatypes should match those in your table)

SQL

create proc spSelectCustomerByNameAndID(
    @name nvarchar(50),
    @id nvarchar(50)
)
begin
   SELECT * FROM ENQUIRY WHERE CUST_NAME = @name AND CUST_ID = @id;
end

Next up from your C# something like this

C#

 using (SqlConnection con = new SqlConnection(connectionString)) {
    using (SqlCommand cmd = new SqlCommand("spSelectCustomerByNameAndID", con)) {
      cmd.CommandType = CommandType.StoredProcedure;

      cmd.Parameters.Add("@name", SqlDbType.VarChar).Value = myselection;
      cmd.Parameters.Add("@id", SqlDbType.VarChar).Value = vidvar ;

      con.Open();
      var reader = cmd.ExecuteReader();

/* As i read your code you are assigning to variables, so your read loop should not iterate or you will only see the last row.*/
                        if(!reader.HasRows){
   //TODO: Handle situation where search yields no results
   return;
} 
                        reader.Read();
                       //TODO: Assign variables
    }
  }

And on the exit i would like to present you to why all the good people were lamenting about not trusting input and such, the very real fear of sql injection. It is always more than a good idea to check that data comming from the UI, especially so if it is from web posts or gets: https://technet.microsoft.com/en-us/library/ms161953%28v=sql.105%29.aspx[^]

How do create a query with where statement with two conditions?

1 solution

Solution 2

Add your solution here

Preview 0

How do create a query with where statement with two conditions?

1 solution

Solution 2

Add your solution here

Preview 0

Existing Members

...or Join us