Sql query and drop down list

[tarscher]

Hi all,

I have 2 dropdownlists that after selection feed the WHERE in a sql
query

SELECT * FROM tbl WHERE a = 'dropdown1' AND b = 'dropdown2'

I also want to add the selection to the dropdownlist that everything of
a and/or b is selected.

Is there some sort of character that I can put between the '' so it
selects everything?

Regards
Stijn

 

[PaulR]

A couple of suggestions:

1. Don't include the where clause if the user selects "everything" for a
and/or b.

2. Instead of using WHERE a = 'dropdown1' use like 'dropdown1' instead. If
they select "everything" use WHERE a like '%' to select everything.

 

[tarscher]

Thanks for the reply.

The % works but only partly. I have a gridview that is populated with
data according to selections made with the 2 dropdownlists. One of the
variable needs to be a varchar, no problem there. The other is an int.
Since % is a string I get an exception. Someone knows how I can work
around this without changing my database.

Regards,
Stijn


PaulR schreef:

 

[PaulR]

I personally would use option 1 I described below. And I would have the
logic to build the query in a stored procedure in the database. Allowing
SELECT access from your application is bad practice, especially if you have
not protected against SQL injection.