Filtering dataset with condition

Question

Hi,

I am using asp.net 2.0 and c#.

I have a dataset, which is getting the employee info. Now I want to filter the gridview based on the name user has put in the search textbox. I am doing this :

        DataSet ds = new DataSet("EmployeeInformation");
        ........ loading DataSet ds with emploee info
        string strExpr;
        strExpr = "Name LIKE %" + txtSearchEmployee.Text.Trim() + "%";
        ds.Tables[0].Select(strExpr);

I am getting error in the last step that the operator is missing.

Please guide me how can I achive this. Thanks in advance.

Answer 1

In SQL, LIKE requires quotation marks around its argument. So, "LIKE \"%foo\%"".

What you are doing is also a BAD IDEA. If a user sends you a search string with special characters in it, you will be vulnerable to a SQL injection attack.

Sanitize your input.

Answer 2

You just need to add single quotes around your LIKE criteria:

strExpr = "Name LIKE '%" + txtSearchEmployee.Text.Trim() + "%'";
ds.Tables[0].Select(strExpr);