StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>The code you have is vulnerable to <a href="http://cs.wikipedia.org/wiki/SQL_injection" rel="nofollow">SQL Injection</a>.</p> <p>In order to avoid that you should utilize <a href="http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter.aspx" rel="nofollow">SqlParameter</a> when possible. The code could then look like this:</p> <pre><code> public DataSet SearchTable() { string sqlStatement = "SELECT * from dbo.Documents1"; bool flag = false; var reference = "something"; // txtRef.Text var subject = "something else"; // txtSubject.Text var sqlCommand = new SqlCommand(); if (!string.IsNullOrWhiteSpace(reference)) { var referenceParameter = new SqlParameter("@referenceParam", SqlDbType.VarChar, 100) { Value = reference }; sqlCommand.Parameters.Add(referenceParameter); sqlStatement += AddWhereLike("Ref", "@referenceParam", flag); flag = true; } if (!string.IsNullOrWhiteSpace(subject)) { var subjectParameter = new SqlParameter("@subjectParam", SqlDbType.VarChar, 100) { Value = reference }; sqlCommand.Parameters.Add(subjectParameter); sqlStatement += AddWhereLike("Subject", "@subjectParam", flag); flag = true; } sqlStatement += " order by Received_Date"; sqlCommand.CommandText = sqlStatement; // do your database reading here } private static string AddWhereLike(string columnName, string paramId, bool isFirstWhereCondition) { var whereCondition = isFirstWhereCondition ? " where " : " and " + columnName + "LIKE N'%" + paramId + "%' "; return whereCondition; } </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload