parameters in search

[Eirik Eldorsen]

I'm trying to use parameters in a search, but I can't get it right.

Before I add parameters this works:
string cmd =
"SELECT * " +
"FROM MyTable" +
"WHERE Title LIKE '%" + keyword + "%'

Here my code with parameters that don't work:
string cmd =
"SELECT * " +
"FROM MyTable " +
"WHERE Title LIKE '%@Keyword%'";

command.CommandText = cmd;
command.Parameters.Add(new SqlParameter("@Keyword", keyword))


What am I doinig wrong?

 

[Eliyahu Goldin]

Erik,

Change to

"WHERE Title LIKE @Keyword";

and include the '%'s in the parameter value:

command.Parameters.Add(new SqlParameter("@Keyword",
String.Format("%{0}%",keyword)));

Eliyahu

 

[Eirik Eldorsen]

Thank you!

Erik,

Change to

"WHERE Title LIKE @Keyword";

and include the '%'s in the parameter value:

command.Parameters.Add(new SqlParameter("@Keyword",
String.Format("%{0}%",keyword)));

Eliyahu

 

[Berimi]

Erik,

String.Format("%{0}%",keyword)));

This is very important.
Take care of the SQL injection.

T.Berimi

 

[Mythran]

Erik,


This is very important.
Take care of the SQL injection.

T.Berimi

Using Parameters, there won't be any SQL Injections...

Mythran