Error in SQL query when searching

Question

I have an SQL query that displays information from different tables in the database. This query is then displayed in a DataGrid and I have some options in a DropDownList to search through the DataGrid for certain values. The problem is the search doesn't display the correct information for CollectName or DeliverName. Code for DropDownList:

 private static readonly Dictionary<string, string> SearchFields = new Dictionary<string, string> {
            { "Customer", "c.Name" },
            { "Department", "jn.Department" },
            { "CollectName", "SELECT Name FROM job_address WHERE AddressType = 3 AND JobID = jn.ID" },
            { "DeliverName", "(SELECT Name FROM job_address WHERE AddressType = 2 AND JobID = jn.ID)" }
        };

In the SQL query CollectName and DeliverName are inner select statements and that's whats causing the problem here because the search for Customer and Department work fine. The SQL query:

SELECT  c.Name,
        COUNT(distinct jn.ID) as Jobs,
        sum(jn.OutTurn) as Outturn,
        SUM(jn.ActualWeight) as GrossWt,
        SUM(jn.CBM) as CBM,
        jn.Department,
        (SELECT Name FROM job_address WHERE AddressType =3 AND JobID = jn.ID) as CollectName,
        (SELECT Name FROM job_address WHERE AddressType =2 AND JobID = jn.ID) as DeliverName       
FROM customer c
LEFT JOIN job_address ja ON c.AccountCode = ja.Code AND c.Company_ID = ja.Company_ID
JOIN  AddressType jat ON ja.AddressType = jat.ID and jat.Description = 'Debtor'
LEFT JOIN job_new jn ON ja.JobID = jn.ID
WHERE c.Company_ID = ?compid
GROUP BY c.ID

I have a search function that takes the value selected from the DropDownList and the value entered in the textbox:

 List<MySqlParameter> param = new List<MySqlParameter>{ new MySqlParameter("compid", CompanyID) };
            StringBuilder SQL = new StringBuilder(SearchSQL);
            if (SearchFieldKey != null && SearchFieldKey.Length > 0)
            {
                SQL.Append(" AND (");
                for (int i = 0; i < SearchFieldKey.Length; i++)
                {
                    if (SearchFields.ContainsKey(SearchFieldKey[i]))
                    {

                        SQL.Append(SearchFields[SearchFieldKey[i]] + " LIKE ?parameter" + i.ToString());
                        param.Add(new MySqlParameter("parameter" + i.ToString(), "%" + SearchTerms[i] + "%"));

                        if (i != SearchFieldKey.Length - 1)
                            SQL.Append(" OR ");
                    }
                    else
                        throw new Exception("Error: Attempted to search on invalid field. Check SearchFields Argument.");
                }
                SQL.Append(") ");
            }

So for example I search for a customer, the SQL query get this line added to end:

WHERE c.Company_ID = ?compid AND (c.Name LIKE ?parameter0) 

And when I search for CollectName or DeliverName the query is this:

WHERE c.Company_ID = ?compid AND (SELECT Name FROM job_address WHERE AddressType = 3 AND JobID = jn.ID LIKE ?parameter0)

Is there a problem with this SQL query that causes CollectName and DeliverName not to work?

Answer 1

The parenthesis doesn't match, it should be

WHERE c.Company_ID = ?compid 
AND (SELECT Name FROM job_address WHERE AddressType = 3 AND JobID = jn.ID) LIKE ?parameter0

To solve this, you can in your dictionary embed the statement:

{ "CollectName", "(SELECT Name FROM job_address WHERE AddressType = 3 AND JobID = jn.ID)" },

Or in your method that build the SQL, embed automatically the subquery:

SQL.Append("(" + SearchFields[SearchFieldKey[i]] + ") LIKE ?parameter" + i.ToString());

Full correction : you should not try to concatenate string together if you are using a StringBuilder:

var param = new List<MySqlParameter> { new MySqlParameter("compid", CompanyID) };
StringBuilder SQL = new StringBuilder(SearchSQL);
if (SearchFieldKey != null && SearchFieldKey.Length > 0)
{
    SQL.Append(" AND (");
    for (int i = 0; i < SearchFieldKey.Length; i++)
    {
        if (SearchFields.ContainsKey(SearchFieldKey[i]))
        {
            SQL.Append("(");
            SQL.Append(SearchFields[SearchFieldKey[i]]);
            SQL.Append(") LIKE ?parameter");
            SQL.Append(i);
            param.Add(new MySqlParameter("parameter" + i.ToString(), "%" + SearchTerms[i] + "%"));

            if (i != SearchFieldKey.Length - 1)
                SQL.Append(" OR ");
        }
        else
            throw new Exception("Error: Attempted to search on invalid field. Check SearchFields Argument.");
    }
    SQL.Append(") ");
}