Question

Iam a little bit Confused for my HR Application I had three type of Users

1) Normal User(location based user) , assigned type U

2) Administrator(company based) , assigned type A

3) Management assigned type M

My problem is in forms DATAGRIDVIEW normal user(HR) should get the employee details of his location(branch) only while the Administrator should get the whole employee details the company company and the Management should get the whole emp details of all their group of companies

I have almost 56 forms where Ia m Calling select query to get data like

 SqlCommand cmd = new SqlCommand("Select * from EMPMASTERTBL" ,CON);
            cmd.Parameters.AddWithValue("@Param1", empshiftdata.Empid);

BUT MY REQUIREMENT IS

For normal user

(if program.usertype="n"){
 SqlCommand cmd = new SqlCommand("Select * from EMPMASTERTBL where branchlctn=@Param1",CON);
                cmd.Parameters.AddWithValue("@Param1", program.lctnpk);

}

for management

(if program.usertype="M"){
     SqlCommand cmd = new SqlCommand("Select * from EMPMASTERTBL",CON);

or

    }

But it is not posible to call three different sql queries in each function
So Is there any idea to concat the two queries?
like

SqlCommand cmd = new SqlCommand("Select * from EMPMASTERTBL where branchlctn=@Param1",CON);
                   cmd.Parameters.AddWithValue("@Param1", program.lctnpk);//for normal user
                    cmd.Parameters.AddWithValue("@Param1", "*");//for Management  user

Answer 1

Why not create the command variable before the conditions, then set the query itself and parameters within the conditions?

// TODO: Improve your naming, which is unconventional and includes odd
// abbreviations ("lctnpk"?)
SqlCommand command = new SqlCommand { Connection = CON };
if (program.usertype=="n") {
    command.CommandText = "Select * from EMPMASTERTBL where branchlctn=@Param1";
    command.Parameters.AddWithValue("@Param1", program.lctnpk);
} else if (program.usertype == "M") {
    command.CommandText = "Select * from EMPMASTERTBL";
}

Alternatively, you could have two parameters, always:

SqlCommand command = new SqlCommand(
    "Select * from EMPMASTERTBL where branchlctn=@Param1 or @usertype='M'" CON);
command.Parameters.AddWithValue("@Param1", program.lctnpk);
command.Parameters.AddWithValue("@usertype", program.usertype);

… and let the query optimizer work out what’s going on. I’d be slightly nervous of this solution – it would quite possibly want different query plans for the different cases; fundamentally you’re executing different queries, so it probably makes sense to reflect that in your SQL.