like keyword in sql

Question

hi string q1 = select * from register where areaofspecific like ' %+ TextBox1.Text + % ' and experience= ' + DropDownList1.SelectedItem.Value.ToString() + ' ; i wrote the query like this but when i execute the query in sql window the correct result will be displayed i gave the textbox value as .netsql in sql table there is cc++java.netsql but nothing will be displayed what can i do

Suthish Nair · Answer

try this.. String q1 = select * from register where areaofspecific like @area and experience = @exp; using (SqlCommand cmd = new SqlCommand(q1 conn)) { cmd.Parameters.AddWithValue(@area String.Format(%{0}% TextBox1.Text)); // for @exp also }

Aaron Colen · Answer

When using parameters the quotes are implied. Use '%' + @Parameter + '%' instead of '%@Parameter%'. Writing '%@Parameter%' the parameter is wrapped in quotes and is interpreted by SQL literally.

karthi vimala · Answer

hi when i used parameterized queries at that time also i didn't get the result string=q1 = select * from register where areaofspecific like '%@area%' ; using ( SqlCommand cmd = new SqlCommand (q1 conn)) { cmd.Parameters.AddWithValue( @area  TextBox4.Text); SqlDataAdapter adp = new SqlDataAdapter (cmd); adp.Fill(ds); } GridView1.DataSource = ds;

Suthish Nair · Answer

Use always Parameterized Queries.