Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Oracle Parameterized query in c#

string sqlCmd = @"SELECT r.row_id AS resp_id,
                         r.name AS resp_name
                  FROM srb.s_resp r,
                       srb.s_per_resp pr,
                       srb.s_contact c,
                       srb.s_user u
                  WHERE r.row_id = pr.resp_id
                    AND u.row_id = c.row_id
                    AND c.person_uid = pr.per_id
                    AND UPPER(u.login) = @login
                 ORDER BY r.name";

OracleConnection con = new OracleConnection(getConnectionString(username, password));
OracleCommand command = con.CreateCommand();

conSiebel.Open();
command.CommandType = CommandType.Text;
command.Connection = con;
command.CommandText = sqlCmd;

command.Parameters.Add(new OracleParameter("login", username));

IDataReader reader = command.ExecuteReader(CommandBehavior.CloseConnection);
reader.Close();

I am trying to add the @login parameter to the above query but it was not adding, Can anyone help me to fix this ?

like image 354
Trinadh Velchuri Avatar asked Jan 23 '17 17:01

Trinadh Velchuri


People also ask

How write parameterized SQL query in C?

Using parameterized queries is a three-step process: Construct the SqlCommand command string with parameters. Declare a SqlParameter object, assigning values as appropriate. Assign the SqlParameter object to the SqlCommand object's Parameters property.

What is parameterized query with example?

A parameterized query is a query in which placeholders are used for parameters and the parameter values are supplied at execution time. The most important reason to use parameterized queries is to avoid SQL injection attacks. Let's take a look at what can happen if we don't use parameterized queries.

Can we parameterize SQL query?

Parameterized SQL queries allow you to place parameters in an SQL query instead of a constant value. A parameter takes a value only when the query is executed, which allows the query to be reused with different values and for different purposes.


1 Answers

Use a colon instead (:login).

 string sqlCmd = @"SELECT  r.row_id AS resp_id,
                                    r.name AS resp_name
                            FROM    srb.s_resp r,
                                    srb.s_per_resp pr,
                                    srb.s_contact c,
                                    srb.s_user u
                            WHERE   r.row_id = pr.resp_id
                                    AND u.row_id = c.row_id
                                    AND c.person_uid = pr.per_id
                                    AND UPPER(u.login) = :login
                                    ORDER BY r.name";
like image 140
chadnt Avatar answered Sep 27 '22 17:09

chadnt