Alternative way to write queries: Parameterized queries .... i guess

[weird0]

i write query in this manner by contatenting a string:

cmd.CommandText = "SELECT acc_name FROM Account_Information
where user_id='" + User_Id + "'";
Is there any other way to do it....

please tell me how to do so and some good link related to that?

[Will]

Doing that is a big no-no for both protection from SQL injection and
for performance. See http://davidhayden.com/blog/dave/arc...0/24/2528.aspx
for info on that.

For your basic CRUD type operations parameterized queries are the way
to go
There are a bunch of example on the net such as
http://www.csharp-station.com/Tutori.../Lesson06.aspx
Other alternatives include object relational mapper such as LLBLGen
Pro, NHibernate. Theses are nice for big projects. At the top level
they make your query look like an object and then you perform actions
against that object.

The last alternative would be using stored procedures for your CRUD
based queries. http://www.codinghorror.com/blog/archives/000117.html
gives a good description on the pro/cons of using them for CRUD

[Jon Skeet [C# MVP]]

weird0 <am********@gmail.comwrote:

i write query in this manner by contatenting a string:

cmd.CommandText = "SELECT acc_name FROM Account_Information
where user_id='" + User_Id + "'";
Is there any other way to do it....

Yes - the above has huge dangers with respect to SQL injection attacks,
as well as making it harder for the query optimiser.

please tell me how to do so and some good link related to that?

It depends on which database provider you're using, but if you look at
SqlCommand.Parameters you'll see an example for the SQL Server
provider.

--
Jon Skeet - <sk***@pobox.com>
http://www.pobox.com/~skeet Blog: http://www.msmvps.com/jon.skeet
If replying to the group, please do not mail me too