Best practices for inline SQL queries

Question

I'm working with an asp.net website that uses a lot of inline SQL queries... and I'm wondering if it is best to create the inline queries on the fly:

int i = 500;

    using (SqlConnection conn = new SqlConnection(connStr))
    {
        SqlCommand com = new SqlCommand(conn);
        ...
        com.CommandText = "select from table where column < @parameter";
        ...
    }

Or to have a class to hold all queries needed for the application. Something like this:

class SqlQueries
{
    private string query1 = 
          "select * from tblEmployees where EmployeeName = @EmployeeName";

    private string query2 = 
          "select * from tblVacation where EmployeeName = @EmployeeName";

    public string Query(string s) 
    { 
        string str = string.Empty;

            switch (s) 
            {
                case "query1":
                    str = query1; 
                    break; 
                case "query2":
                    str = query2; 
                    break;
            }     

    return str;    

    }
}

Thank you!

Answer 1

I've used a lot of ADO.NET queries in my day and I have always used the first method. The second method is an interesting idea, but it might be cumbersome to edit those queries if you are at another place in the code that uses it. It also makes it harder to see what a query is doing at a particular place in code. Example:

string sql = "Update User set age = @age where UserId = @UserId";

tells a developer what is happening, while:

string sql = SqlQueries.Query("updateAge");

Leaves questions about what table/columns are being updated. Also, with the first one, you know exactly what params need to be added.

If you are writing this query in several places that might change things

Answer 2

If you absolutely have to have "inline" sql as opposed to stored procedures (and I have done this for utility type applications that merely interact with a database, rather than own it), I would suggest putting your SQL into an embedded resource file. This will make your queries easier to maintain (although you will still need to re-compile your app to make changes).

Answer 3

It's not terrible to put the literal directly in the method, as long as you always call that same method every time you want to run that query. However, if you are going to copy that string literal into multiple places in your code, then a constant is definitely preferred. However, rather than taking a string as the argument for the Query method in your second example, it should take an enumeration value.

However, if you are using the second method you described, I would ask you why you don't just start using stored procedures instead?