Click here to Skip to main content
15,889,462 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
In my application i have ask my friend to help me with coding the filtering tools but we got stock in some parts, so i need your kind support guys to help me with updating my code below such as "var query = query + " where " + conditions;" also "string conditions = "";" we dont have that big experience in c# so for that i refer to you guys if you need more explanation the below youtube link will give more info please check it

https://www.youtube.com/watch?v=nh5fbBuUeOE

C#
protected void Sortcarbtn_Click(object sender, EventArgs e)
        {

            if (Session["location"] != null)
            {

                using (SqlConnection CarsortCon = new SqlConnection(cs))
                {

                    string maker = (barndcardrlst.SelectedIndex > 0) ? barndcardrlst.SelectedValue : null;
                    string yearfrom = (CarYearfrmDrDw.SelectedIndex > 0) ? CarYearfrmDrDw.SelectedValue : null;
                    string yearto = (CarYeartoDrDw.SelectedIndex > 0) ? CarYeartoDrDw.SelectedValue : null;
                    string gearddl = (GearDrDw.SelectedIndex > 0) ? GearDrDw.SelectedValue : null;
                    string CarCond = (CarCondDrDw.SelectedIndex > 0) ? CarCondDrDw.SelectedValue : null;
                    string prisfrom = (CarPriceFrmDrDw.SelectedIndex > 0) ? CarPriceFrmDrDw.SelectedValue : null;
                    string pristo = (CarPriceToDrDw.SelectedIndex > 0) ? CarPriceToDrDw.SelectedValue : null;
                    string Contrddl = (countrdrdolst.SelectedIndex > 0) ? countrdrdolst.SelectedValue : null;
                    string statddl = (statedrdolst.SelectedIndex > 0) ? statedrdolst.SelectedValue : null;
                    string cityddl = (citiesdrdolst.SelectedIndex > 0) ? citiesdrdolst.SelectedValue : null;


                    string query = (@"select * from ads where Category = @Category 
                    AND Country = @Country AND Maker=@brand AND Gear=@G AND Condition=@COND AND Year >@startYear and Year <@endYear");

                    var location = Convert.ToString(Session["location"]);
                    var cat = Convert.ToString(Request.QueryString["cat"]);


                    string conditions = "";


                    if (maker != null) conditions += " maker like '%" + maker + "%' ";

                    if (yearfrom != null) conditions += " and year > " + yearfrom;

                    if (yearto != null) conditions += " and year < " + yearto;

                    if (gearddl != null) conditions += " and gear = '%" + gearddl + "%' ";

                    if (CarCond != null) conditions += " Condition = '%" + CarCond + "%' ";

                    if (prisfrom != null) conditions += " and price > " + prisfrom;

                    if (pristo != null) conditions += " and price < " + pristo;

                    if (Contrddl != null) conditions += " Country = '%" + Contrddl + "%' ";

                    if (statddl != null) conditions += " State = '%" + statddl + "%' ";

                    if (cityddl != null) conditions += " City = '%" + cityddl + "%' ";



                    var query = query + " where " + conditions;


                    CarsortQ.Fill(CarsortDataSet);

                    cateshowlistview.DataSource = CarsortDataSet.Tables[0];
                    cateshowlistview.DataBind();

                }

            }
        }
Posted
Comments
[no name] 5-Aug-14 6:39am    
Wow, second consecutive question I've come across this morning with SQL injection vulnerabilites!

You should *NEVER* be doing this: if (maker != null) conditions += " maker like '%" + maker + "%' ";

1 solution

Take a look at this article: ADO.NET, the right way[^]

The section applicable to what you're looking for starts at "Querying using parameterized queries".
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900