another sql query statment

Question

ok thanks alot for all who help me ,but now i have another problem i want to get this statement correct also

if (byNametextBox.Text != null && byBuildingtextBox.Text !=null && seTextBoxPublic1.Text == null)
{
    da = new SqlDataAdapter("SELECT * FROM Students WHERE name='" +     byNametextBox.Text +"and [buil-id]='"+byBuildingtextBox.Text+ "'", MyConn);

}

i want to select from the same table with two condition please

Answer 1

Better for security if you use parameters in your SQL query.

Answer 2

I suppose you should create an SqlCommand with 2 parameters. The code you posted here is not safe for SQL Injection attacks.

Please follow:

http://msdn.microsoft.com/en-us/library/ms161953.aspx

Answer 3

To answer your question, however, your code creates the SQL:

SELECT * FROM Students WHERE name='NAMEand [buil-id]='ID'

should be

SELECT * FROM Students WHERE name='NAME' and [buil-id]='ID'

Answer 4

Please use parameters! If for some reason you're against them, this should work:

string strStatement = String.Format("SELECT * FROM Students WHERE [name] = '{0}' AND [buil-id] = '{1}'", byNametextBox.Text, byBuildingtextBox.Text);
da = new SqlDataAdapter(strStatement, MyConn);