How to format keywords in SQL Server Full Text Search

Question

I have a sql function that accepts keywords and returns a full text search table.

How do I format the keyword string when it contains multiple keywords? Do I need to splice the string and insert "AND"? (I am passing the keywords to the method through Linq TO SQL)

Also, how do I best protect myself from sql injection here.? Are the default ASP.NET filters sufficient?

thanks

Answer 1

I would use "AND" and asterisks on each word. The asterisk will help the matching be a bit wider since I believe it is best to return too many rather than too few. For example, a search for "Georgia Peach" would use the keyword string '"Georgia*" AND "Peach*"' (the double quotes around each word are important).

And I believe the ASP.NET Filters are sufficient. Plus, since you are using parameterized queries (which LINQ to SQL does), you are pretty safe.