Question

I would like to pass some operators through as querystring parameters so that I can convert them, along with a value into an SQL query. The idea would be to let the querystring parameters dictate wether the page returns search results where prices are equal to, greater than or equal to, greater than, less than or less than or equal to as follows:

=, >=, >, < and <=

I’m not sure what the best practise is for passing these operators through is, could anybody help me out? Would you pass through ascii codes or simply text like e, gte, gt, lt, lte and then convert them on results page that builds the query?

Thanks guys!

Answer 1

As user Kon said, use HttpServerUtility.UrlEncode. I’ve once written a tiny little class to simplify working with query strings so that I do not have to call Server.UrlEncode.

As a side note, keep an eye on SQL injection aka Little Bobby Tables:

(Source)