Question

I would like to know something .

I try to retrieve 2 files .

One is register for a group 2 , and one for a group 10 .

So the field is Files.Group .

One user is register to the group 1 and the group 10.

This is the query I use to retrieve files .

SELECT Files.Id, Files.Name, Files.Date, Files.Path, Files.[Group] FROM Files WHERE Files.[Group] = " + param + "ORDER BY Files.Id DESC"

Param is a cookie who get the group, creating a chain like this 2|10 .

This doesn’t work actually.. And i don’t know how can I pass in the query the two groups. Should I separate them by a coma ? like Files.Group = 2,10 ?

Or is it something else ? To pass 2 parameters ?

Answer 1

Description

You should use SqlParameter to prevent Sql injections. Use the IN Statetment to pass in a comma seperated list of you group ids.

Sample

// value from cookie
string groups = "2,10,99";

// Build where clause and params
List<string> where = new List<string>();
List<SqlParameter> param = new List<SqlParameter>();
foreach(string group in groups.Split(','))
{
    int groupId = Int32.Parse(group);
    string paramName = string.Format("@Group{0}", groupId);
    where.Add(paramName);
    param.Add(new SqlParameter(paramName, groupId));
}

// create command
SqlConnection myConnection = new SqlConnection("My ConnectionString");
SqlCommand command = new SqlCommand("SELECT Files.Id, Files.Name, Files.Date, " +
                            "Files.Path, Files.[Group] " +
                            "FROM Files " +
                            "WHERE Files.[Group] in (" + string.Join(",", param) + ")" +
                            "ORDER BY Files.Id DESC", myConnection);
command.Parameters.AddRange(param.ToArray());

More Information

• MSDN – IN (Transact-SQL)
• C# SqlParameter Example