Implementation Example of Ranked Search in ASP.NET

using System;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
using System.Text.RegularExpressions;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace WebTest
{
    public partial class search : Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
        }

        protected void SearchButton_Click(object sender, EventArgs e)
        {
            DataTable dt = SearchDB(Server.HtmlDecode(SearchBox.Text));
            if (dt == null)
                return;
            var row = new TableRow();
            //Add the column headers
            for (int j = 0; j < dt.Columns.Count; j++)
            {
                var headerCell = new TableHeaderCell {Text = dt.Columns[j].ColumnName};
                row.Cells.Add(headerCell);
            }

            ResultTable.Rows.Add(row);

            //Add the row values
            for (int i = 0; i < dt.Rows.Count; i++)
            {
                row = new TableRow();
                for (int j = 0; j < dt.Columns.Count; j++)
                {
                    var cell = new TableCell {Text = dt.Rows[i][j].ToString()};
                    row.Cells.Add(cell);
                }
                // Add the TableRow to the Table
                ResultTable.Rows.Add(row);
            }
        }

        /// <summary>
        /// Searches the database in all columns and returns the result as a datatable.
        /// </summary>
        /// <param name="searchString">Search String</param>
        /// <returns>DataTable with the results all columns ordered in rank</returns>
        public static DataTable SearchDB(string searchString)
        {
            if (searchString == null)
                return null;
            //Clean Up search string to avoid SQL Injection
            var reg = new Regex(@"[^\w(@)\|&]");
            searchString = reg.Replace(searchString, "");
            searchString = searchString.Trim();
            if (searchString == "")
                return null;

            //The search string
            var dt = new DataTable();
            using (
                var connection =
                    new SqlConnection(ConfigurationManager.ConnectionStrings["DBConnection"].ConnectionString))
            {
                var userDataset = new DataSet();
                var myDataAdapter = new SqlDataAdapter(
                    "SELECT TOP(20) * FROM FREETEXTTABLE(dbo.Names, *, @param) AS r INNER JOIN Names ON r.[KEY] = Names.MyKey order by RANK DESC",
                    connection);
                myDataAdapter.SelectCommand.Parameters.Add("@param", SqlDbType.VarChar, 255);
                myDataAdapter.SelectCommand.Parameters["@param"].Value = searchString;
                myDataAdapter.Fill(dt);
            }
            return dt;
        }
    }
}