CODEWITHSUNDEEP
c#oracle-databasec#-4.0ado.netsql-injection
Trinadh Velchuri
Trinadh Velchuri

Reputation: 189

Oracle Parameterized query in c#

string sqlCmd = @"SELECT r.row_id AS resp_id,
                         r.name AS resp_name
                  FROM srb.s_resp r,
                       srb.s_per_resp pr,
                       srb.s_contact c,
                       srb.s_user u
                  WHERE r.row_id = pr.resp_id
                    AND u.row_id = c.row_id
                    AND c.person_uid = pr.per_id
                    AND UPPER(u.login) = @login
                 ORDER BY r.name";

OracleConnection con = new OracleConnection(getConnectionString(username, password));
OracleCommand command = con.CreateCommand();

conSiebel.Open();
command.CommandType = CommandType.Text;
command.Connection = con;
command.CommandText = sqlCmd;

command.Parameters.Add(new OracleParameter("login", username));

IDataReader reader = command.ExecuteReader(CommandBehavior.CloseConnection);
reader.Close();

I am trying to add the @login parameter to the above query but it was not adding, Can anyone help me to fix this ?

Upvotes: 9

Views: 9243

Answers (1)

chadnt
chadnt

Reputation: 1135

Use a colon instead (:login).

 string sqlCmd = @"SELECT  r.row_id AS resp_id,
                                    r.name AS resp_name
                            FROM    srb.s_resp r,
                                    srb.s_per_resp pr,
                                    srb.s_contact c,
                                    srb.s_user u
                            WHERE   r.row_id = pr.resp_id
                                    AND u.row_id = c.row_id
                                    AND c.person_uid = pr.per_id
                                    AND UPPER(u.login) = :login
                                    ORDER BY r.name";

Upvotes: 11

Related Questions