?
Solved

C# String concatenation for a sql query

Posted on 2014-04-15
7
Medium Priority
?
231 Views
Last Modified: 2014-04-16
This is simple, but I am having trouble getting it right. I have a sql string in C# pulling data from a table. The string is:

string strData = "select * FROM vwHistory where lowTeam1 = '" + ddlTeam.SelectedValue + "' AND Year = " + ddlYear.SelectedValue + "' OR lowTeam2 = '" + ddlTeam.SelectedValue + "' AND Year = " + ddlYear.SelectedValue + " order by Date DESC, TransID DESC";

I'm getting an incorrect syntax error at the OR clause. What am I doing wrong? Thanks.
0
Comment
Question by:dodgerfan
7 Comments
 
LVL 11

Assisted Solution

by:MajorBigDeal
MajorBigDeal earned 1000 total points
ID: 40002972
There is a single quote after ddlYear.SelectedValue  but none before it.
0
 
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 40002973
If you use parameterized queries, then you don't have to worry about such trivial things   ; )
0
 
LVL 23

Accepted Solution

by:
Michael Fowler earned 1000 total points
ID: 40002976
Check your quotes

"select * FROM vwHistory where lowTeam1 = '" + ddlTeam.SelectedValue + "' AND Year = " + ddlYear.SelectedValue + " OR lowTeam2 = '" + ddlTeam.SelectedValue + "' AND Year = " + ddlYear.SelectedValue + " order by Date DESC, TransID DESC";

You had an extra single quote in your string

   AND Year = " + ddlYear.SelectedValue + "'

Michael
0
Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 

Author Closing Comment

by:dodgerfan
ID: 40002989
Thanks I knew it would be something I kept missing.
0
 
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 40003011
I certainly hope this code isn't exposed to the web...
0
 
LVL 11

Expert Comment

by:MajorBigDeal
ID: 40003059
dodgerfan, you might want to look at Linq or Entity Framework to avoid embedding raw SQL strings into your code.  It is so much easier and more flexible to debug DB-related code than the approach you are using.
0
 
LVL 7

Expert Comment

by:niralshah
ID: 40003754
Replace your code with following code.

string strData = string.format("select * FROM vwHistory where (lowTeam1 = '{0}' AND Year={1}) OR (lowTeam2 = '{0}' AND Year = {1}) order by Date DESC, TransID DESC", ddlTeam.SelectedValue,ddlYear.SelectedValue,ddlTeam.SelectedValue);
0

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Entity Framework is a powerful tool to help you interact with the DataBase but still doesn't help much when we have a Stored Procedure that returns more than one resultset. The solution takes some of out-of-the-box thinking; read on!
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
Free Data Recovery software is an advanced solution from Kernel Tools to recover data and files such as documents, emails, database, media and pictures, etc. It supports recovery from physical & logical drive after a hard disk crash, accidental/inte…
Watch the video of Kernel Migrator for SharePoint, which demonstrate the process easily of migration from SharePoint to SharePoint, OneDrive for Business & Google Drive servers, Public Folder to SharePoint, File Server to SharePoint. The tool has va…

584 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question