Using C# Variables in SQL Query

Question

I'm very new to this. There might be something obvious I'm completely missing, but...

When making an SQL query (ASP.NET with C#) I can get this:

var query = db.Query("SELECT * FROM pageinfo WHERE pageID = 1");

to work, and yet this:

var pageID=1;
var query = db.Query("SELECT * FROM pageinfo WHERE pageID = @pageID");

does not.

Basically, all I want to do is place a variable into the query. Is there some special syntax for doing this?

Thanks.

@user2124495 you will end up in Sql Injection. please use parametrized queries — Ravi Gadag
– Ravi Gadag, Commented Mar 18, 2013 at 11:43

Habib · Accepted Answer · 2013-03-18 11:58:05Z

15

Is there some special syntax for doing this?

Yes, Use SQLParameter.

Something like:

SqlCommand cmd = new SqlCommand("SELECT * FROM pageinfo WHERE pageID = @pageID");
cmd.Parameters.AddWithValue("@pageID", 2);

Your current method db.Query seems to be a your own implementation. You can overload that method to receive a list of SqlParameter and then add those parameters to your command. This will prevent you from SQL Injection

edited Mar 18, 2013 at 11:58

answered Mar 18, 2013 at 11:39

Habib

224k30 gold badges420 silver badges446 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user2124495 Over a year ago

Thanks! Got that to work now, but now that I don't have the 'query' variable, how would I get the result?

Habib Over a year ago

You can either use SqlDataReader to read data or Populate a DataSet/DataTable from command

felix Antony · Accepted Answer · 2013-03-18 11:48:38Z

0

var pageID=1;
var query = db.Query("SELECT * FROM pageinfo WHERE pageID = '"+ PAGEid +"');

answered Mar 18, 2013 at 11:48

felix Antony

1,46014 silver badges28 bronze badges

1 Comment

Habib Over a year ago

Don't. Read more about SQL Injection

Collectives™ on Stack Overflow

Using C# Variables in SQL Query

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related