Question

Suppose you have a long, complicated query to pull needed results that takes some parameters. Any will do, but for the sake of an example:

SELECT
    q.PROD_ID, q.NAME, q.STANDARD_PROD, q.DESCRIPTION, q.PART_NUMBER,
    q.COMMENTS, q.DESCRIPTION_URL,
    PROD_CATEGORY.DESCRIPTION AS CATEGORY_DESCRIPTION,
    PROD_TYPES.DESCRIPTION AS PROD_TYPE
FROM
    (SELECT
        PROD.PROD_ID,
        PROD.PROD_TYPE_ID,
        PROD.NAME,
        PROD.STANDARD_PROD,
        PROD.PROD_CATEGORY_ID,
        PROD.DESCRIPTION,
        PROD.PART_NUMBER,
        PROD.COMMENTS,
        PROD.DESCRIPTION_URL
     FROM
        (SELECT
            PROD_ID,
            PROD_TYPE_ID
         FROM
            XREF_PRODSYS
         WHERE
            (PROD_TYPE_ID = (SELECT
                                PROD_TYPE_ID
                             FROM
                                PROD_TYPES
                             WHERE
                                (NAME LIKE @prod_type_name)))) AS p
     LEFT OUTER JOIN PROD ON p.PROD_ID = PROD.PROD_ID
     WHERE
        (PROD.NAME LIKE @prod_name)
        AND (PROD.HIDDEN = 0)) AS q
LEFT OUTER JOIN PROD_CATEGORY ON q.PROD_CATEGORY_ID = PROD_CATEGORY.PROD_CATEGORY_ID
LEFT OUTER JOIN PROD_TYPES ON q.PROD_TYPE_ID = PROD_TYPES.PROD_TYPE_ID

This particular query takes two parameters, presumably passed to the .NET web app through GET/POST.

Is there a cleaner way to store such a long query, rather than putting it in the C# source of the webapp page? I know the below “quick and dirty” approach works fine, but it does
make the code expand a lot and become a bit unmanageable. For example:

    //inside Page_Load...
    SqlCommand cmd = new SqlCommand();
    cmd.Connection = con;
    cmd.Parameters.Add("@prod_type_name", SqlDbType.VarChar).Value = _type_name;
    cmd.Parameters.Add("@prod_name", SqlDbType.VarChar).Value = _prod_name;
    cmd.CommandText = @"
    SELECT     q.PROD_ID, q.NAME, q.STANDARD_PROD, q.DESCRIPTION, q.PART_NUMBER, q.COMMENTS, q.DESCRIPTION_URL, 
              PROD_CATEGORY.DESCRIPTION AS CATEGORY_DESCRIPTION, PROD_TYPES.DESCRIPTION AS PROD_TYPE
    FROM         (SELECT     PROD.PROD_ID, PROD.PROD_TYPE_ID, PROD.NAME, PROD.STANDARD_PROD, PROD.PROD_CATEGORY_ID, PROD.DESCRIPTION, 
                                      PROD.PART_NUMBER, PROD.COMMENTS, PROD.DESCRIPTION_URL
               FROM          (SELECT     PROD_ID, PROD_TYPE_ID
                                       FROM          XREF_PRODSYS
                                       WHERE      (PROD_TYPE_ID =
                                                                  (SELECT     PROD_TYPE_ID
                                                                    FROM          PROD_TYPES
                                                                    WHERE      (NAME LIKE @prod_type_name)))) AS p LEFT OUTER JOIN
                                      PROD ON p.PROD_ID = PROD.PROD_ID
               WHERE      (PROD.NAME LIKE @prod_name) AND (PROD.HIDDEN = 0)) AS q LEFT OUTER JOIN
              PROD_CATEGORY ON q.PROD_CATEGORY_ID = PROD_CATEGORY.PROD_CATEGORY_ID LEFT OUTER JOIN
              PROD_TYPES ON q.PROD_TYPE_ID = PROD_TYPES.PROD_TYPE_ID
              ";
              //... do stuff with cmd

Answer 1

Why not just put this all into a stored procedure and call the stored procedure, passing in the parameters appropriately?

How to create a stored procedure

...
cmd.CommandText = "sprocname";
cmd.CommandType = CommandType.StoredProcedure
...