asp.net - How to replace variable in where clause in c# -
i have oracle query fetch data database , show them in gridview dynamically.the query used select *from employee location=?location , age=?age , marks=?marks .variable beginning ? placeholders filled @ runtime.suppose here extracted place holders selecting drop down , got location='chemmad' , marks='100'.i need logic insert values created in place holders , if thing miss example here age missing, have capture missing one.in nutshell have query dropdown like
string query = "select *from employee location=?location , age=?age , marks=?marks"; i got values @ runtime place holders
string values = "location='chemmad' , marks='100'"; so want replace values placeholders , same time need find missing 1 here age
**edit** i stored combinations of queries in oracle database :) , fetching @ run time , replacing values.i think have find location of = sign , need find words either side??
string strvalues = "location='chemmad' , marks='100'"; // bad , cause sql injection attacks. // want object(s) can use in parameterized query. depending on input dynamically create part of string. this: var parametervalues = new { location = "chemmad", marks = 100 }; const string searchterm = " "; var query = @"select * employee location=?location , age=?age , marks=?marks"; var part1 = query.substring(0, query.indexof(searchterm, stringcomparison.ordinalignorecase)); // following line not necessary , won't used. illustrates how remainder of query. var part2 = query.substring(query.indexof(searchterm, stringcomparison.ordinalignorecase) + searchterm.length, query.length - part1.length - searchterm.length); var mydynamicquery = part1 + searchterm; mydynamicquery = mydynamicquery + "location = :location "; mydynamicquery = mydynamicquery + "and marks = :marks "; mydynamicquery contains string: select * employee location = :location , marks = :marks
next
- create oracle connection
- create dbparameters
- execute query against oracle command object
see this article how create oracle connection .net , use parameterized query.
Comments
Post a Comment