Question

I want to add a simple select statement in my C# code. Sample looks like below. The value like y in fname comes from a parameter.
//select lname from myTable where fname = ‘y’

Here’s what I m doing. I m obviously getting Sql Exception. How do I correct it? Thanks.

string strOrdersOrigSQL = "SELECT LastName FROM Employees";
// Concatenate the default SQL statement with the "Where" clause and add an OrderBy clause
       strOrdersSQL = strOrdersOrigSQL + "where FirstName ="+ 'strFname';

Answer 1

But it can be done as

string strOrdersOrigSQL = "SELECT LastName FROM Employees";
// Concatenate the default SQL statement with the "Where" clause and add an OrderBy clause
       strOrdersSQL = strOrdersOrigSQL + " where FirstName ='"+ strFname + "'";

This is not proper way of doing it since it can be affected by SQL Injection. Use parameterised queries instead.