Build an SQL query without SqlCommand

[Sin Jeong-hun]

I need to programatically change the SelectCommand of an
SqlDataSource. When I query I use SqlCommand and all the character
escaping is automatically done with SqlCommand.Parameters.Add(); Now,
since SelectCommand property is just a text, I need to manually do the
character escaping. Is there any other built-in query builder that I
can use in this situation?

[Maximiliano]

On 27 oct, 12:39, Sin Jeong-hun <[e-mail]:

I need to programatically change the SelectCommand of an
SqlDataSource. When I query I use SqlCommand and all the character
escaping is automatically done with SqlCommand.Parameters.Add(); Now,
since SelectCommand property is just a text, I need to manually do the
character escaping. Is there any other built-in query builder that I
can use in this situation?

What do you mean?, something like that

string sql = "select top 10 au_lname, phone from authors where
au_lname = 'White'";

(Note the single quotes)

However Parameters are the best practice, for security someone could
inject you database with dangerous code.
Regards.