Have Geek Brain

Custom sql parameter using IN clause in gridview - c #

When I posted the following SQL query,

SELECT
   [ItemID], [Name], [RelDate], [Price], [Status] 
FROM 
   [item_k] 
WHERE 
   [ItemID] IN (" + itemIDs + ")

in custom sql gridview statements, it gets converted to

SELECT 
   ItemID, Name, RelDate, Price, Status   
FROM 
   item_k 
WHERE 
   (ItemID IN ([ + itemIDs + ]))

and when i execute the request the following error is displayed

SQL Execution Error
Invalid column name '+ itemIDs+'

What's the problem?

thanks

0


a source to share


3 answers


Have you tried putting + itemID + in single quotes?



+1


a source


The problem with your string concat method is that it will probably leave you vulnerable to SQL injection. I wouldn't try to fix this approach, but go for a parameterized query that doesn't require string concatenation.



+1


a source 


SELECT [ItemID], [Name], [RelDate], [Price], [Status] FROM [item_k] WHERE [ItemID] IN (' + itemIDs + ')

changed to and it worked!

0


a source






More articles:


All Articles