Search SqlDatabase using different data ASP.NET C#

Question

Hi i can currently search the sql database using the following code, but i can only search using the Customer_firstname is there a way i can search for the surname as well as the firstname? i have found numerous tutorials and examples but all of the examples only use one datatype for the search.

protected void Button_cus_pmr_Click(object sender, EventArgs e)

    {

        //select all the data from the PMR table where it is equal to the text in the search text box
        string staSearch = "select * FROM [PMR] where (Customer_Firstname like '%" + TextBox_cus_pmr.Text.ToString() + "%)";
        SqlDataSource1.SelectCommand = staSearch;//perform the staSearch query on the SqlDataSource1

    }

You should look into Store procedures or the entity framework instead of using inline sql. They can be a security nightmare waiting to happen. — Lareau
– Lareau, Commented Feb 17, 2015 at 18:54
@Lareau Or rather parameters, since they are a lot simpler to use for queries than stored procedures. But the fact remains that never ever use string catenation like this. — Sami Kuhmonen
– Sami Kuhmonen, Commented Feb 23, 2015 at 10:22

Sam · Accepted Answer · 2015-02-17 18:57:50Z

1

You should be able to simply add a second condition for the surname. For example:

string staSearch = "select * FROM [PMR] where (Customer_Firstname like '%" + TextBox_cus_pmr.Text.ToString() + "% OR Customer_Surname like '%" + TextBox_surName.Text.ToString() + "%')";

Replace TextBox_surName with the name of the surname text box and Customer_Surname with the name of the surname database column.

Like Lareau mentioned in a comment, this isn't a very safe way to do queries because a user could run other SQL commands on your server by entering them into the textbox. For more information on ways to avoid this, take a look at this article.

edited Feb 17, 2015 at 18:57

answered Feb 17, 2015 at 18:51

Sam

5,0144 gold badges32 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

colliec Over a year ago

The code worked perfectly i will have a look at the article and improve the security.

Collectives™ on Stack Overflow

Search SqlDatabase using different data ASP.NET C#

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related