parameters in search

[Eirik Eldorsen]

I'm trying to use parameters in a search, but I can't get it right.

Before I add parameters this works:
string cmd =
"SELECT * " +
"FROM MyTable" +
"WHERE Title LIKE '%" + keyword + "%'

Here my code with parameters that don't work:
string cmd =
"SELECT * " +
"FROM MyTable " +
"WHERE Title LIKE '%@Keyword%'";

command.CommandText = cmd;
command.Parameters.Add(new SqlParameter("@Keyword", keyword))
What am I doinig wrong?
--
Eirik Eldorsen

[Eliyahu Goldin]

Erik,

Change to

"WHERE Title LIKE @Keyword";

and include the '%'s in the parameter value:

command.Parameters.Add(new SqlParameter("@Keyword",
String.Format("%{0}%",keyword)));

Eliyahu

"Eirik Eldorsen" <ku*******@hotmail.com> wrote in message
news:e8**************@TK2MSFTNGP12.phx.gbl...

I'm trying to use parameters in a search, but I can't get it right.

Before I add parameters this works:
string cmd =
"SELECT * " +
"FROM MyTable" +
"WHERE Title LIKE '%" + keyword + "%'

Here my code with parameters that don't work:
string cmd =
"SELECT * " +
"FROM MyTable " +
"WHERE Title LIKE '%@Keyword%'";

command.CommandText = cmd;
command.Parameters.Add(new SqlParameter("@Keyword", keyword))
What am I doinig wrong?
--
Eirik Eldorsen

[Eirik Eldorsen]

Thank you!
"Eliyahu Goldin" <re*************@monarchmed.com> skrev i melding
news:%2****************@TK2MSFTNGP09.phx.gbl...

Erik,

Change to

"WHERE Title LIKE @Keyword";

and include the '%'s in the parameter value:

command.Parameters.Add(new SqlParameter("@Keyword",
String.Format("%{0}%",keyword)));

Eliyahu

"Eirik Eldorsen" <ku*******@hotmail.com> wrote in message
news:e8**************@TK2MSFTNGP12.phx.gbl...

I'm trying to use parameters in a search, but I can't get it right.

Before I add parameters this works:
string cmd =
"SELECT * " +
"FROM MyTable" +
"WHERE Title LIKE '%" + keyword + "%'

Here my code with parameters that don't work:
string cmd =
"SELECT * " +
"FROM MyTable " +
"WHERE Title LIKE '%@Keyword%'";

command.CommandText = cmd;
command.Parameters.Add(new SqlParameter("@Keyword", keyword))
What am I doinig wrong?
--
Eirik Eldorsen

[Berimi]

Erik,
Goldin wrote:

String.Format("%{0}%",keyword)));
This is very important.
Take care of the SQL injection.

T.Berimi

"Eliyahu Goldin" <re*************@monarchmed.com> a écrit dans le message de
news: %2****************@TK2MSFTNGP09.phx.gbl... Erik,

Change to

"WHERE Title LIKE @Keyword";

and include the '%'s in the parameter value:

command.Parameters.Add(new SqlParameter("@Keyword",
String.Format("%{0}%",keyword)));

Eliyahu

"Eirik Eldorsen" <ku*******@hotmail.com> wrote in message
news:e8**************@TK2MSFTNGP12.phx.gbl...

I'm trying to use parameters in a search, but I can't get it right.

Before I add parameters this works:
string cmd =
"SELECT * " +
"FROM MyTable" +
"WHERE Title LIKE '%" + keyword + "%'

Here my code with parameters that don't work:
string cmd =
"SELECT * " +
"FROM MyTable " +
"WHERE Title LIKE '%@Keyword%'";

command.CommandText = cmd;
command.Parameters.Add(new SqlParameter("@Keyword", keyword))
What am I doinig wrong?
--
Eirik Eldorsen

[Mythran]

"Berimi" <be****@algeriecom.com> wrote in message
news:uK**************@TK2MSFTNGP12.phx.gbl...

Erik,
Goldin wrote:

>String.Format("%{0}%",keyword)));

This is very important.
Take care of the SQL injection.

T.Berimi

Using Parameters, there won't be any SQL Injections...

Mythran