Question

really a simple question , I have two Variables “one_hour_ago” and “current_time”, I need to pass these two variables in my sql command like :

string commandString = "SELECT * from myTable where time between one_hour_ago and current_time";

here is what I have but I get syntax error

string commandString = "SELECT * from myTable where TS between ' and /" + one_hour_ago + "'" + current_time + "/"; 

Thanks

Answer 1

string sqlString = "SELECT * FROM myTable WHERE time BETWEEN  @before AND @current_time"; 
SqlCommand oCmd = new SqlCommand(sqlString , connString);
oCmd.Parameters.AddWithValue("@before", date_before);
oCmd.Parameters.AddWithValue("@current_time", currentTime);

where date_before and currentTime are the parameters you pass to the method.

this should take care of the sql injection stuff