Question

I have below code in code behind for btnShowReport_Click:

SqlDataSource1.SelectParameters.Clear();  
SqlDataSource1.SelectParameters.Add("username", txtUsername.Text);  
SqlDataSource1.SelectParameters.Add("printer", ddlPrinter.Text);  
SqlDataSource1.SelectParameters.Add("to", Date.convertDateSolar2Gregorian(txtDateFrom_datepicker.Text));
SqlDataSource1.SelectParameters.Add("from", Date.convertDateSolar2Gregorian(txtDateTo_datepicker.Text));
SqlDataSource1.SelectCommand = "SELECT * FROM JobLog WHERE UserName=@username and   PrinterName=@printer and TimeSubmitted between @to and @from";  

I want when user doesn’t fill some text boxes, in the query, the criteria of the textbox was ignored in query.
I hope you understand what I want.

Answer 1

You can dynamically build the SQL query using a StringBuilder, however this makes your code prone to SQL Injection attacks and you should rather look at creating a stored procedure in SQL Server using Dynamic SQL

Here’s the StringBuilder example though if you absolutely have to build the query in code:

  protected void Page_Load(object sender, EventArgs e)
{
    Dictionary<string, string> parameters = new Dictionary<string, string>();
    SqlDataSource1.SelectParameters.Clear();

    string name = txtName.Text;
    string surname = txtSurname.Text;

    if (name.Length > 0)
    {
        SqlDataSource1.SelectParameters.Add("Name", txtName.Text);
        parameters.Add("Name", name);
    }

    if (surname.Length > 0)
    {
        SqlDataSource1.SelectParameters.Add("Surname", txtSurname.Text);
        parameters.Add("Surname", surname);
    }

    SqlDataSource1.SelectCommand = GetSelectQuery("Customers", parameters);
    //Bind SqlDataSource1 to gridview etc...
}

private string GetSelectQuery(string table, Dictionary<string, string> parameters)
{
    var query = new System.Text.StringBuilder();
    query.Append(String.Format("SELECT * FROM {0}", table));

    for (int i = 0; i < parameters.Count; i++)
    {
        var param = parameters.ElementAt(i);
        if (i == 0)
            //Add the first parameter
            query.Append(String.Format(" WHERE {0}='{1}' ",param.Key, param.Value));
        else
            query.Append(String.Format(" AND {0}='{1}'", param.Key, param.Value));
    }
    return query.ToString();
}