Welcome to the Lounge

OriginalGriff wrote:

This is why parameterised queries are so important!

pLucian wrote:

By parameterized, you mean stored procedures or what ?

SqlCommand cmd = SqlCommand("SELECT * FROM tab WHERE name = " + tbName.Text);

SqlCommand cmd = SqlCommand("SELECT * FROM tab WHERE name = @NAME");
cmd.AddWithValue("@NAME", tbName.Text);

OriginalGriff wrote:

(Yes, yes, I know - "don't use SELECT * FROM" because it... yada yada yada! Don't be so picky!)

OriginalGriff wrote:

This is why parameterised queries are so important!

private SqlDataReader GetSomeStuff(SqlConnection conn, List<string> vals)
{

    // Create query.
    StringBuilder sb = new StringBuilder();
    for (int i = 0; i < vals.Count; i++)
    {
        if (i != 0) sb.Append(", ");
        sb.Append("@param" + i.ToString());
    }
    string query = string.Format("SELECT * FROM TheTable WHERE TheColumn IN ({0})", sb.ToString());


    // Add each parameter to command.
    SqlCommand cmd = new SqlCommand(query, conn);
    for(int i = 0; i < vals.Count; i++)
    {
        cmd.Parameters.Add(new SqlParameter("param" + i.ToString(), vals[i]));
    }


    // Execute.
    return cmd.ExecuteReader();

}

aspdotnetdev wrote:

Now, was that so hard?

aspdotnetdev wrote:

one can create an intermediate table to bulk insert data into, generate a unique batch ID from that, then pass that ID to the stored procedure

Electron Shepherd wrote:

all you needed to do was double up any single quotes in each parameter

Dalek Dave wrote:

Although to my dying day I will NEVER use Aluminum!

digital man wrote:

And they still don't know what a wanker is! Smile