C#

Gerald Schwab wrote:

Uhh, he asked what he should concatenate to the end of the SQLString string variable in order to generate a SQL statement that would filter by Parts.ID

string SQLString = "Select * FROM Costs"; //What else to put here??

How do I programatically say, 'strPartNumberInput is Parts.ID'

Gerald Schwab wrote:

I simply demonstrated how to create the SQL string he was interested in creating. I am fully aware of SQL injection attacks and always use typed parameters with stored procedures in "my" solutions.

Gerald Schwab wrote:

Maybe you should try being less arrogant next time.

Wasif Ehsan wrote:

String SQLString="SELECT * FROM Costs WHERE PartID= "+txtPartNumber.Text;

string SQLString = "SELECT * FROM Costs WHERE Costs.PartID = @PartID";
SqlCommand cmd = new SqlCommand();
cmd.Connection = myConnection;
cmd.CommandText = SQLString;
cmd.Parameters.Add("@PartID", strPartNumberInput);

cmd.CommandText = "SELECT * FROM Products where Name = '"+txtSearch.Text+"'";

'; DELETE FROM Products; --

SELECT * FROM Products where Name = ''; DELETE FROM Products; --

'; UPDATE Products SET Price = 0.01; --

leckey wrote:

BindGrid(strConnectSQL, SQLString, DataGrid1);

SqlCommand cmd = new SqlCommand();<br />
cmd.Connection = new SqlConnection(strConnectSQL);<br />
cmd.CommandText = SQLString;<br />
cmd.Parameters.Add ("@PartID", partNumber);

leckey wrote:

do I have to go through the SqlCommand cmd = new SqlCommand again?

private void btnSearchPartNumber_Click(object sender, System.EventArgs e)<br />
		{<br />
			strPartNumberInput = txtPartNumber.Text;<br />
			int partNumber = Convert.ToInt32(strPartNumberInput);//THIS IS WRONG. First, partNumber is a varchar so can get rid of this. But need the Parts.ID which is a number.<br />
			string SQLString = "Select * FROM Costs where Costs.PartID = @PartID"; <br />
			SqlCommand cmd = new SqlCommand();<br />
			cmd.Connection = new SqlConnection(strConnectSQL);<br />
			cmd.CommandText = SQLString;<br />
			cmd.Parameters.Add ("@PartID", partNumber);<br />
			BindGrid (strConnectSQL, SQLString, DataGrid1 );<br />
		}

private void btnSearchPartNumber_Click(object sender, System.EventArgs e)<br />
		{<br />
			strPartNumberInput = txtPartNumber.Text;<br />
			int partNumber = Convert.ToInt32(strPartNumberInput);<br />
			string SQLString = "Select * FROM Costs c INNER JOIN Parts p ON c.PartID = p.Id where p.PartNumber = @PartID"; <br />
			SqlCommand cmd = new SqlCommand();<br />
			cmd.Connection = new SqlConnection(strConnectSQL);<br />
			cmd.CommandText = SQLString;<br />
			cmd.Parameters.Add ("@PartID", partNumber);<br />
			BindGrid (strConnectSQL, SQLString, DataGrid1 );<br />
		}

private void btnSearchPartNumber_Click(object sender, System.EventArgs e)<br />
		{<br />
			strPartNumberInput = txtPartNumber.Text;<br />
			int partNumber = Convert.ToInt32(strPartNumberInput);<br />
			string SQLString = "Select * FROM Costs c INNER JOIN Parts p ON c.PartID = p.Id where p.PartNumber = @PartID"; <br />
			SqlCommand cmd = new SqlCommand();<br />
			cmd.Connection = new SqlConnection(strConnectSQL);<br />
			cmd.CommandText = SQLString;<br />
			cmd.Parameters.Add ("@PartID", partNumber);<br />
			//BindGrid (strConnectSQL, SQLString, DataGrid1 );<br />
			BindGrid (strConnectSQL, cmd, DataGrid1);<br />
		}

BindGrid(cmd, DataGrid1);

private void BindGrid (SqlCommand cmd, System.Web.UI.WebControls.DataGrid DGrid)
{
    // create data adapter
    SqlDataAdapter adapter = new SqlDataAdapter(command);
 
    // create and fill dataset 
    DataSet ds = new DataSet();
    adapter.Fill(ds);
 
    // fill and bind data to Datagrid
    DGrid.DataSource = ds;
    DGrid.DataBind();

    // Close Connection
    conn.Close();
}

leckey wrote:

Since 'conn' is not in BindGrid, I'm not sure what to close