tags:

views:

113

answers:

2

i am adding parameter by

qry = qry.Replace("{criteria}", "info.abc LIKE '%?val%'");

command not worked if i removed ' ' from the command then it give a error how i can search the table in c#

+2  A: 

As per the syntax of TSQL - Like you require to put search value between ' '

Example :

WHERE title LIKE '%computer%'

syntax

match_expression [ NOT ] LIKE pattern [ ESCAPE escape_character ]
Pranay Rana
A: 

Another way to do this which is more explicit - and in my opinion more readable because it avoids the crockety parts of the SQL syntax:

SqlDataReader r = new SqlCommand("SELECT * FROM the_table").ExecuteReader();
object[] values = new object[5000];
r.GetValues(values);
foreach (string value in values)
    if (value.Length > 4)
        if (value.Contains("val"))
            new SqlCommand("UPDATE the_table SET value = 'newValue' WHERE "+
                           "value = '"+value+"'").ExecuteNonQuery();
CSpangled
This solution has a risk of sql injection (see http://en.wikipedia.org/wiki/SQL_injection). It would be better to use parameterized queries. Also, it it can have a high impact on performance (it needs to run as many queries as there are records in "the_table")
ckarras
@ckarras: Thanks, didn't know about the SQL inject attack. Performance shouldn't be a worry, though. Focus first on getting it right, then on getting it fast if you need to.
CSpangled
@CSpangled :- `Focus first on getting it right, then on getting it fast if you need to`. Where is the connection string used? Without connection string how will it know which database and which instance to execute command against?
Ankit Rathod